PT-2024-26247 · Unknown · Php-Censor

Published 2024-05-14 · Updated 2024-07-08 · CVE-2024-34914

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions php-censor versions 2.1.4

Description The issue allows attackers to bruteforce the remember key value, potentially gaining access to accounts that have checked "remember me" when logging in. This could lead to unauthorized access.

Recommendations For php-censor version 2.1.4, upgrade to version 2.1.5 to mitigate exposure. As a temporary workaround, consider disabling the "remember me" feature until the issue is resolved.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

CWE-328

Related Identifiers

CVE-2024-34914

GHSA-FQW7-839J-HVXJ

Affected Products

Php-Censor

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-34914 · Security Note
• https://osv.dev/vulnerability/GHSA-fqw7-839j-hvxj · Vendor Advisory
• https://github.com/php-censor/php-censor · Note
• https://github.com/php-censor/php-censor/commit/7b011d1b60f543e6ed814315a285cc80074d12e5 · Note
• https://chmod744.super.site/redacted-vulnerability · Note
• https://twitter.com/oktsec/status/1810239783370653815 · Twitter Post