PT-2024-17140 · Unknown · Macrozheng Mall

Heddazhu · Published 2024-11-22 · Updated 2024-11-23 · CVE-2024-11619

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions macrozheng mall versions up to 1.0.3

Description A problematic issue has been found in the JWT Token Handler component, leading to the use of a default cryptographic key. The complexity of an attack is rather high, and exploitation is known to be difficult. The vendor was contacted about this disclosure but did not respond, and the issue posted on GitHub was deleted without explanation.

Recommendations For macrozheng mall versions up to 1.0.3, consider disabling the JWT Token Handler component until a patch is available to prevent the use of the default cryptographic key. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1394

Related Identifiers

CVE-2024-11619

Affected Products

Macrozheng Mall

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-11619 · Security Note
• https://osv.dev/vulnerability/CVE-2024-11619 · Vendor Advisory
• https://github.com/macrozheng/mall/issues/880 · Note
• https://vuldb.com/?id.285842 · Note
• https://vuldb.com/?submit.444666 · Note
• https://vuldb.com/?ctiid.285842 · Note
• https://twitter.com/CVEnew/status/1860199586867945731 · Twitter Post