PT-2023-31464 · Galxe · Galxe

Published 2023-12-25 · Updated 2024-11-04 · CVE-2023-50059

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Galxe platform version 1.0

Description The issue allows a remote attacker to obtain sensitive information via the Web3 authentication process of Galxe. The signed message lacks a nonce, which is a random number. This lack of a nonce enables a potential Web3 Authentication Replay Attack.

Recommendations For Galxe platform version 1.0, consider temporarily disabling the Web3 authentication process until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation. Avoid using the Web3 authentication process in production environments until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2023-50059

Affected Products

Galxe

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-50059 · Security Note
• https://galxe.com · Note
• https://twitter.com/VulmonFeeds/status/1739280309391093911 · Twitter Post
• https://t.me/cvenotify/100580 · Telegram Post
• https://twitter.com/CVEnew/status/1785381723905142875 · Twitter Post