CVE-2017-16031: High severity Socket Socket.io Node.js vulnerability
Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on Math.random() to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtaining sensitive information.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2017-16031?
CVE-2017-16031 is a vulnerability in Socket.io 0.9.6 and earlier that allows attackers to guess and gain access to socket IDs in socket.io servers.
How does CVE-2017-16031 affect Socket.io?
CVE-2017-16031 affects Socket.io versions 0.9.6 and earlier, allowing attackers to exploit predictable socket IDs.
What is the severity of CVE-2017-16031?
The severity of CVE-2017-16031 is high with a CVSS score of 7.5.
How can an attacker exploit CVE-2017-16031?
An attacker can exploit CVE-2017-16031 by guessing the predictable socket IDs and gain unauthorized access to socket.io servers.
Is there a fix available for CVE-2017-16031?
Yes, the fix for CVE-2017-16031 is available in the commit 67b4eb9abdf111dfa9be4176d1709374a2b4ded8 of the Socket.io repository.