PT-2024-38924 · Unknown · Kitsada8621 Digital Library Management System

Zihe · Published 2024-08-29 · Updated 2024-09-02 · CVE-2024-8297

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: kitsada8621 Digital Library Management System version 1.0

Description: A vulnerability was found in the kitsada8621 Digital Library Management System. It has been classified as problematic and affects the function JwtRefreshAuth of the file middleware/jwt refresh token middleware.go. The manipulation of the argument Authorization leads to improper output neutralization for logs. It is possible to launch the attack remotely.

Recommendations: To fix this issue, apply the patch 81b3336b4c9240f0bf50c13cb8375cf860d945f1 to the kitsada8621 Digital Library Management System version 1.0. As a temporary workaround, consider disabling the JwtRefreshAuth function until the patch is applied. Restrict access to the middleware/jwt refresh token middleware.go file to minimize the risk of exploitation. Avoid using the Authorization argument in the affected API endpoint until the issue is resolved.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

CWE-117

Related Identifiers

CVE-2024-8297

Affected Products

Kitsada8621 Digital Library Management System

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2024-8297 · Security Note
• https://github.com/kitsada8621/Digital-Library-Management-System/commit/81b3336b4c9240f0bf50c13cb8375cf860d945f1 · Patch
• https://osv.dev/vulnerability/CVE-2024-8297 · Vendor Advisory
• https://twitter.com/CVEnew/status/1829141421586100290 · Twitter Post
• https://vuldb.com/?submit.394613 · Note
• https://twitter.com/CVESource/status/1829152183914201553 · Twitter Post
• https://vuldb.com/?ctiid.276072 · Note
• https://t.me/cvenotify/92847 · Telegram Post
• https://twitter.com/cracbot/status/1830848274171080861 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1829169238050783620 · Twitter Post
• https://twitter.com/oktsec/status/1829070055469994427 · Twitter Post
• https://vuldb.com/?id.276072 · Note
• https://t.me/cvedetector/4394 · Telegram Post
• https://github.com/kitsada8621/Digital-Library-Management-System/issues/1 · Note