9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2023-50475

GHSA ID

GHSA-jj93-39pf-7mcf

EPSS Score

0.34106%

CWE

CWE-327

Published

12/21/2023

Updated

1/2/2024

KEV Status

Technology

JavaScript

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-50475

CVE-2023-50475: bsock uses weak hashing algorithms

An issue was discovered in the bsock component of bcoin-org bcoin that allows remote attackers to obtain sensitive information via weak hashing algorithms in the component \vendor\faye-websocket.js.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-50475

CVE-2023-50475:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2023-50475

GHSA ID

GHSA-jj93-39pf-7mcf

EPSS Score

0.34106%

CWE

CWE-327

Published

12/21/2023

Updated

1/2/2024

KEV Status

Technology

JavaScript

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
bsock	npm	<= 0.1.11

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability documentation explicitly identifies two cryptographic functions in faye-websocket.js:

Hybi.generateAccept uses SHA1 for WebSocket handshakes (line 2919)
_handshakeSignature uses MD5 for message authentication (line 1462) Both algorithms are specifically called out in CWE-327 and the advisory descriptions. The code examples show direct use of crypto.createHash() with 'sha1' and 'md5' arguments, confirming the vulnerable implementations. High confidence comes from multiple independent sources (NVD, GitHub Advisory, and issue reports) all identifying these specific functions and algorithms.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

9.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2023-50475: bsock uses weak hashing algorithms

CVE-2023-50475:

9.1

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Basic Information

Basic Information

Technical Details

9.1

9.1

CVE-2023-50475: bsock uses weak hashing algorithms

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI