Lucene search

NCSC.chVULNRICHMENT:CVE-2024-24554

HistoryJun 24, 2024 - 7:11 a.m.

CVE-2024-24554 Bludit - Insecure Token Generation

2024-06-2407:11:36

CWE-287

CWE-338

NCSC.ch

github.com

bludit

token

vulnerability

md5

api

authentication

predictable

CVSS4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/SC:N/VI:H/SI:N/VA:N/SA:N

AI Score

6.7

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the user token. This allows attackers to authenticate against the Bludit API.

CNA Affected

[
  {
    "repo": "https://github.com/bludit/bludit/",
    "vendor": "Bludit",
    "product": "Bludit",
    "versions": [
      {
        "status": "affected",
        "version": "2.0"
      }
    ],
    "platforms": [
      "Linux",
      "Windows",
      "MacOS"
    ],
    "packageName": "Bludit",
    "collectionURL": "https://www.bludit.com/",
    "defaultStatus": "unaffected"
  }
]

References

www.redguard.ch/blog/2024/06/20/security-advisory-bludit/