CVE-2017-16031: hackerone socket.io node module Use of Insufficiently Random Values
Vulnerability summary
CVE-2017-16031 is a high (CVSS 7.5) Use of Insufficiently Random Values vulnerability in hackerone socket.io node module. EPSS estimates a 1.97% chance of exploitation in the next 30 days, higher than 80.1% of scored vulnerabilities.
Timeline
- 04-06-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on `Math.random()` to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtaining sensitive information.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.97%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
-0.03 pp
From 2.00% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Hackerone1 product
- socket.io node module≤ 0.9.6
Npm1 product
- socket.io< 0.9.7
Socket1 product
- socket.io≤ 0.9.6
3 vendors · 3 products
References
8 links- github.com/socketio/socket.io/commit/67b4eb9abdf111dfa9be4176d1709374a2b4ded8X Refsource MISCIssue TrackingPatchThird Party AdvisoryWEB
