CVE-2024-51478 Use of a Broken or Risky Cryptographic Algorithm in YesWiki
Weak hashing with hard-coded salt allows recovery of password reset keys, enabling attackers to take over any user account.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-51478?
CVE-2024-51478 is a critical vulnerability in yeswiki, published on 31 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
YesWiki is a wiki system written in PHP. Prior to 4.4.5, the use of a weak cryptographic algorithm and a hard-coded salt to hash the password reset key allows it to be recovered and used to reset the password of any account. This issue is fixed in 4.4.5.
Weakness: CWE-327
Which versions are affected by CVE-2024-51478?
2 open source packages ship an affected version, including yeswiki/yeswiki. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
yeswiki/yeswiki Packagist | All versions | 4.4.5 |
yeswiki/yeswiki Packagist | All versions | 4.4.5 |
Products include Yeswiki Yeswiki.
How do I fix CVE-2024-51478?
Upgrade yeswiki/yeswiki to 4.4.5 or later.
Is CVE-2024-51478 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-51478 exists.
Other vulnerabilities in yeswiki
- CVE-2025-46348 YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download
- CVE-2018-1000641 Deserialization in n/a
- CVE-2025-31131 Path Traversal allowing arbitrary read of files in Yeswiki
- CVE-2025-46349 YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
- CVE-2025-24017 YesWiki Vulnerable to Unauthenticated DOM Based XSS
Sources
Also known as GHSA-4fvx-h823-38v3.