PT-2024-25949 · Solidui · Solidui

Nevercodecorrect · Published 2024-05-05 · Updated 2024-08-22 · CVE-2024-34527

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SolidUI version 0.4.0

Description The issue concerns an unnecessary print statement in the spaces plugin/app.py file for an OpenAI key. This printed string might be logged, potentially exposing sensitive information.

Recommendations For SolidUI version 0.4.0, consider removing or disabling the unnecessary print statement in the spaces plugin/app.py file to prevent potential logging of sensitive information.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2024-34527

Affected Products

Solidui

References · 7

• https://osv.dev/vulnerability/CVE-2024-34527 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34527 · Security Note
• https://github.com/CloudOrc/SolidUI/blob/00d96b53bd0acf082996cef45b0f292eaba22fb7/solidui/spaces_plugin/app.py#L77 · Note
• https://github.com/CloudOrc/SolidUI/issues/279 · Note
• https://t.me/cvenotify/79164 · Telegram Post
• https://t.me/cvenotify/91779 · Telegram Post
• https://twitter.com/CVEnew/status/1787561518076436858 · Twitter Post