UpHeron
All vulnerabilities

Servers and applications

CVE-2024-51478

Use of a Broken or Risky Cryptographic Algorithm in YesWiki

Severity
Critical 9.1
Published
31 Oct 2024
Last changed
17 Jun 2026
Added to UpHeron
3 Nov 2026
Fixed in
4.4.5
Also known as
GHSA-4fvx-h823-38v3
Sources
NVD, Project advisories (GitHub)

Description

YesWiki is a wiki system written in PHP. Prior to 4.4.5, the use of a weak cryptographic algorithm and a hard-coded salt to hash the password reset key allows it to be recovered and used to reset the password of any account. This issue is fixed in 4.4.5.

Affected software

SoftwareAffected versions
YesWikiServers and applications · cpe:a:yeswiki:yeswiki
  • Every version before 4.4.5
YesWikiServers and applications · github:yeswiki/yeswiki
  • Every version before 4.4.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-51478
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-51478
  • GitHub Advisory Database https://github.com/advisories/GHSA-4fvx-h823-38v3
  • github.com https://github.com/YesWiki/yeswiki/security/advisories/GHSA-4fvx-h823-38v3