4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
7 High
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.5%
When invoking a capability with a chain depth of 2, i.e., it is delegated directly from the root capability, the expires
property is not properly checked against the current date or other date
param. This can allow invocations outside of the original intended time period. A zcap still cannot be invoked without being able to use the associated private key material.
@digitalbazaar/zcap
v9.0.1 fixes expiration checking.
A zcap could be revoked at any time.
CPE | Name | Operator | Version |
---|---|---|---|
@digitalbazaar/zcap | lt | 9.0.1 |
github.com/advisories/GHSA-hp8h-7x69-4wmv
github.com/digitalbazaar/zcap/commit/261eea040109b6e25159c88d8ed49d3c37f8fcfe
github.com/digitalbazaar/zcap/commit/55f8549c80124b85dfb0f3dcf83f2c63f42532e5
github.com/digitalbazaar/zcap/pull/82
github.com/digitalbazaar/zcap/security/advisories/GHSA-hp8h-7x69-4wmv
nvd.nist.gov/vuln/detail/CVE-2024-31995
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
7 High
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.5%