PT-2024-16985 · Unknown · Central Dogma

Minwoox · Published 2024-02-01 · Updated 2024-02-09 · CVE-2024-1143

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Central Dogma versions prior to 0.64.1

Description A Cross-Site Scripting (XSS) vulnerability in Central Dogma could allow for the leakage of user sessions and subsequent authentication bypass. The issue targets the RelayState of Security Assertion Markup Language (SAML), enabling malicious actors to leak user sessions and compromise authentication mechanisms. This can facilitate unauthorized access to sensitive resources.

Recommendations For Central Dogma versions prior to 0.64.1, upgrade to version 0.64.1 or later to mitigate the risk associated with the authentication bypass. No viable workarounds are currently available for this vulnerability, so applying the provided patch promptly is recommended.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-1143

GHSA-34Q3-P352-C7Q8

GHSA-QFV2-3P2F-VG48

Affected Products

Central Dogma

References · 15

• https://github.com/line/centraldogma/security/advisories/GHSA-34q3-p352-c7q8 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-34q3-p352-c7q8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1143 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1143 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qfv2-3p2f-vg48 · Vendor Advisory
• https://github.com/line/centraldogma · Note
• https://github.com/line/centraldogma/commit/8edcf913b88101aff70008156b0881850e005783 · Note
• https://twitter.com/Komodosec/status/1754478758554447902 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1754426820383130055 · Twitter Post
• https://twitter.com/CVEnew/status/1753306644815982907 · Twitter Post
• https://twitter.com/mstfknn/status/1754447609224147086 · Twitter Post
• https://twitter.com/fridaysecurity/status/1754428095686132076 · Twitter Post
• https://t.me/cvenotify/70170 · Telegram Post
• https://t.me/cvenotify/70163 · Telegram Post
• https://t.me/cvenotify/70161 · Telegram Post