VulnerabilityAnalyzed
CVE-2024-24554
This allows attackers to authenticate against the Bludit API.
MEDIUM 6.0EPSS 0.24%
Does this matter?
Lower severity and a low EPSS score (0.24%). Track it; it rarely justifies an emergency change on its own.
Description
Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the user token. This allows attackers to authenticate against the Bludit API.
- CVSS 4.0
- 6.0 MEDIUMCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.24% probability · 15th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287, CWE-338
- Affected
- bludit/bludit
- Source
- vulnerability@ncsc.ch
References
- https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/Third Party Advisory
- https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.