CVE-2024-28120: codeium

csirt@kutim:~/threat-intel/cve/CVE-2024-28120

CVSS 7.5 · High EPSS 0,65%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada codeium. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

codeium-chrome is an open source code completion plugin for the chrome web browser. The service worker of the codeium-chrome extension doesn't check the sender when receiving an external message. This allows an attacker to host a website that will steal the user's Codeium api-key, and thus impersonate the user on the backend autocomplete server. This issue has not been addressed. Users are advised to monitor the usage of their API key.

Rincian

Terbit di NVD: 11 Maret 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-284: Improper Access Control
EPSS (30 hari): 0,65% peluang dieksploitasi; lebih tinggi dari 49,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
codeium	codeium	Versi 1.2.52

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/Exafunction/codeium-chrome/security/advisories/GHSA-8c7j-2h97-q63p exploit · advisory vendor
https://securitylab.github.com/advisories/GHSL-2024-027_GHSL-2024-028_codeium-chrome exploit · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.