PT-2024-28438 · Toy-Blog · Toy-Blog

Kisaragieffective · Published 2024-07-01 · Updated 2024-07-02 · CVE-2024-39314

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions toy-blog versions 0.4.3 through 0.4.14 toy-blog versions prior to 0.4.14

Description The administrative password is leaked through the command line parameter. This issue was patched in version 0.5.0.

Recommendations For versions 0.4.14 and later, pass --read-bearer-token-from-stdin to the launch arguments and feed the token from the standard input as a workaround. For versions prior to 0.4.14, update to version 0.5.0 to resolve the issue. For versions 0.4.3 through 0.4.13, update to version 0.5.0 to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-214

CWE-200

Related Identifiers

CVE-2024-39314

GHSA-Q8G2-C3X5-GP89

Affected Products

Toy-Blog

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39314.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-39314 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39314 · Vendor Advisory
• https://github.com/KisaragiEffective/toy-blog/security/advisories/GHSA-q8g2-c3x5-gp89 · Note
• https://github.com/KisaragiEffective/toy-blog/commit/4d003e46a944d8f44ea02c63f4beefa4cbe1f4f7 · Note