CVE-2017-16031

2018-04-2600:00:00

hackerone

www.cve.org

0.002 Low

EPSS

Percentile

55.3%

JSON

Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on Math.random() to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtaining sensitive information.

CNA Affected

[
  {
    "product": "socket.io node module",
    "vendor": "HackerOne",
    "versions": [
      {
        "status": "affected",
        "version": "<=0.9.6"
      }
    ]
  }
]