Lucene search

VulDBCVE-2024-8005

HistoryAug 20, 2024 - 2:15 p.m.

CVE-2024-8005

2024-08-2014:15:11

CWE-798

VulDB

web.nvd.nist.gov

vulnerability

demozx gf_cms

critical

jwt authentication

hard-coded credentials

remote attack

public exploit

upgrade

patch

be702ada7cb6fdabc02689d90b38139c827458a5

security issue

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS4

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/SC:N/VI:L/SI:N/VA:L/SA:N

EPSS

0.002

Percentile

65.4%

JSON

A vulnerability was found in demozx gf_cms 1.0/1.0.1. It has been classified as critical. This affects the function init of the file internal/logic/auth/auth.go of the component JWT Authentication. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.2 is able to address this issue. The patch is named be702ada7cb6fdabc02689d90b38139c827458a5. It is recommended to upgrade the affected component.

Affected configurations

Nvd

Vulners

Vulnrichment

Node

demozxgf_cmsRange1.0–1.0.2

VendorProductVersionCPE
demozxgf_cms*cpe:2.3:a:demozx:gf_cms:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
demozx	gf_cms	*	cpe:2.3:a:demozx:gf_cms::::::::

CNA Affected

[
  {
    "vendor": "demozx",
    "product": "gf_cms",
    "versions": [
      {
        "version": "1.0",
        "status": "affected"
      },
      {
        "version": "1.0.1",
        "status": "affected"
      }
    ],
    "modules": [
      "JWT Authentication"
    ]
  }
]

References

github.com/demozx/gf_cms/commit/be702ada7cb6fdabc02689d90b38139c827458a5

github.com/demozx/gf_cms/commit/de51cc57a96ccca905c837ef925c2cc3a5241383

github.com/demozx/gf_cms/issues/5

github.com/demozx/gf_cms/issues/5#issuecomment-2296590417

vuldb.com/?ctiid.275199

vuldb.com/?id.275199

vuldb.com/?submit.393981

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS4

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/SC:N/VI:L/SI:N/VA:L/SA:N

EPSS

0.002

Percentile

65.4%

JSON

Related for CVE-2024-8005