PT-2024-29279 · Puncia · Puncia

Sch227 · Published 2024-07-19 · Updated 2024-07-22 · CVE-2024-41124

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Puncia versions prior to 0.21

Description The issue arises from API URLS utilizing HTTP instead of HTTPS for communication, leading to potential issues like Eavesdropping, Data Tampering, Unauthorized Data Access, and MITM Attacks.

Recommendations For versions prior to 0.21, upgrade to release version 0.21 to address the issue by using HTTPS instead of HTTP connections. At the moment, there is no information about other workarounds for this issue.

Exploit

Fix

Missing Encryption of Sensitive Data

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-311

CWE-319

Related Identifiers

CVE-2024-41124

GHSA-RWCJ-7JJP-4W38

Affected Products

Puncia

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41124.json · Exploit
• https://osv.dev/vulnerability/GHSA-rwcj-7jjp-4w38 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41124 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41124 · Vendor Advisory
• https://github.com/ARPSyndicate/puncia · Note
• https://github.com/ARPSyndicate/puncia/commit/033f3b68126eabbb2040ce16e2c3a2ce17437fbd#diff-3ec6c2de51e702726b23c452e3f4a899f6f4253af9fbf5be7254a5c1407ab526 · Note
• https://github.com/ARPSyndicate/puncia/security/advisories/GHSA-rwcj-7jjp-4w38 · Note
• https://github.com/ARPSyndicate/puncia/issues/8 · Note
• https://github.com/ARPSyndicate/puncia/commit/033f3b68126eabbb2040ce16e2c3a2ce17437fbd · Note
• https://t.me/cvedetector/1234 · Telegram Post