PT-2024-20535 · Open-Irs · Open-Irs

Degamisu · Published 2024-02-02 · Updated 2024-02-10 · CVE-2024-24757

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions open-irs versions prior to 1.0.1

Description The issue concerns an accidentally uploaded .env file when working with git actions, which contains sensitive information. This problem has been fixed in version 1.0.1. The solution involves discontinuing all sensitive keys and turning them into secrets.

Recommendations For versions prior to 1.0.1, update to version 1.0.1 to resolve the issue. As a temporary workaround, consider restricting access to the sensitive keys in the .env file until the update is applied.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-24757

GHSA-7R69-3VWH-WCFR

Affected Products

Open-Irs

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24757.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-24757 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24757 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1753493746669203532 · Twitter Post
• https://twitter.com/CVEnew/status/1753446335078916300 · Twitter Post
• https://github.com/Degamisu/open-irs/security/advisories/GHSA-7r69-3vwh-wcfr · Note