CVE-2017-16031 Insecure randomness in socket.io
HighCVSS 7.5
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on Math.random() to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtaining sensitive information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm socket.io(npm) | <= 0.9.6 | No fix listed |
| socket.io | <= 0.9.6 | No fix listed |
| HackerOne socket.io node module | = <=0.9.6 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com issue-tracking third-party-advisory
- github.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory
- github.com
- www.npmjs.com
- nodesecurity.io third-party-advisory