PT-2024-26112 · Unknown · Wows Karma

Bloodytakao · Published 2024-05-10 · Updated 2024-05-14 · CVE-2024-34695

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions WOWS Karma versions prior to 0.17.4.1

Description The issue allows a user to bypass cooldown validation by sending multiple post creation API requests simultaneously. This is achieved by clicking the "create" button multiple times on a post creation prompt before the modal closes. Although the user's metrics are not refreshed more than once due to concurrent karma updates, the cooldown validation is bypassed.

Recommendations For versions prior to 0.17.4.1, update to version 0.17.4.1 to resolve the issue. As a temporary workaround, consider restricting the ability to send multiple post creation requests simultaneously to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-799

Related Identifiers

CVE-2024-34695

GHSA-V6CC-V976-MJ8G

Affected Products

Wows Karma

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34695.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-34695 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34695 · Security Note
• https://github.com/SakuraIsayeki/WOWS-Karma/commit/3210b516fa3551e30fe760c915f7656d9046e69a · Note
• https://github.com/SakuraIsayeki/WOWS-Karma/security/advisories/GHSA-v6cc-v976-mj8g · Note
• https://github.com/SakuraIsayeki/WOWS-Karma/commit/6cb825976f28c68d79172aeda00e955bf5853de2 · Note