PT-2024-31803 · Gotenna · Gotenna Pro Atak Plugin

Clayton Smith + 2 · Published 2024-09-26 · Updated 2024-10-17 · CVE-2024-45838

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: goTenna Pro ATAK Plugin versions prior to the current version

Description: The goTenna Pro ATAK Plugin does not encrypt callsigns in messages, potentially revealing sensitive information about users. It is advised not to use sensitive information in callsigns when using this and previous versions of the plugin. The issue can be mitigated by updating to the current plugin version, which uses AES-256 encryption for callsigns in encrypted operation.

Recommendations: Update to the current plugin version, which uses AES-256 encryption for callsigns in encrypted operation. As a temporary workaround, consider not using sensitive information in callsigns until the update is applied.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2024-45838

Affected Products

Gotenna Pro Atak Plugin

References · 7

• https://osv.dev/vulnerability/CVE-2024-45838 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45838 · Security Note
• https://t.me/cvedetector/6450 · Telegram Post
• https://t.me/cvenotify/97338 · Telegram Post
• https://twitter.com/CVEnew/status/1839358125574611185 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-24-270-05 · Note
• https://t.me/cvenotify/98585 · Telegram Post