VulnerabilityAnalyzed
CVE-2024-29886
This vulnerability is fixed by 1.2.6.
MEDIUM 5.3EPSS 0.26%
Does this matter?
Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own.
Description
Serverpod is an app and web server, built for the Flutter and Dart ecosystem. An issue was identified with the old password hash algorithm that made it susceptible to rainbow attacks if the database was compromised. This vulnerability is fixed by 1.2.6.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.26% probability · 18th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-916
- Affected
- serverpod/serverpod
- Source
- security-advisories@github.com
References
- https://github.com/serverpod/serverpod/commit/a78b9e9f1de74d1300633a122b6cc0f064139ad6Patch
- https://github.com/serverpod/serverpod/security/advisories/GHSA-r75m-26cq-mjxcVendor Advisory
- https://github.com/serverpod/serverpod/commit/a78b9e9f1de74d1300633a122b6cc0f064139ad6Patch
- https://github.com/serverpod/serverpod/security/advisories/GHSA-r75m-26cq-mjxcVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.