CVE-2024-11619

Katalog CVE

CVSS 8.1 · High EPSS 0,73%

Kerentanan Use of Default Cryptographic Key pada macrozheng mall. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3. Affected by this issue is some unknown functionality of the component JWT Token Handler. The manipulation leads to use of default cryptographic key. The complexity of an attack is rather high. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way. Instead the issue posted on GitHub got deleted without any explanation.

Rincian

Terbit di NVD

22 November 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1394: Use of Default Cryptographic Key

EPSS (30 hari)

0,73% peluang dieksploitasi; lebih tinggi dari 53,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.285842 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.444666 advisory pihak ketiga · vdb entry
• https://github.com/macrozheng/mall/issues/880 broken link
• https://vuldb.com/?ctiid.285842 permissions required · vdb entry