Critical severity · published Oct 31, 2024
CVE-2024-51478
Use of a Broken or Risky Cryptographic Algorithm in YesWiki
9.1
CVSS
0.4%
EPSS
No
On KEV
Description
YesWiki is a wiki system written in PHP. Prior to 4.4.5, the use of a weak cryptographic algorithm and a hard-coded salt to hash the password reset key allows it to be recovered and used to reset the password of any account. This issue is fixed in 4.4.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YE
yeswiki · YesWiki
< 4.4.5 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-51478
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-51478
Patch
https://github.com/YesWiki/yeswiki/commit/b5a8f93b87720d5d5f033a4b3a131ce0fb621dbc
Patch
https://github.com/YesWiki/yeswiki/commit/e1285709f6f6a2277bd0075acf369f33cefd78f7
Exploit
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-4fvx-h823-38v3
More from yeswiki
9.8
CVE-2026-46670
YesWiki: Unauthenticated SQL Injection
9.8
CVE-2026-52778
YesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)
9.8
CVE-2025-46348
YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download
9.8
CVE-2025-46347
YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution
9.8
CVE-2018-1000641
YesWiki version <= cercopitheque beta 1 contains a PHP Object Injection vulnerability in Unserialising user entered parameter in i18n.inc.php that can result in execution of code,…