CVE-2024-11619

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-11619
A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3. Affected by this issue is some unknown functionality of the component JWT Token Handler. The manipulation leads to use of default cryptographic key. The complexity of an attack is rather high. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way. Instead the issue posted on GitHub got deleted without any explanation.

5.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 3.4

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:A/AC:H/Au:N/C:P/I:P/A:P

Exploitability : 3.2 / Impact : 6.4

Access Vector ADJACENT_NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://github.com/macrozheng/mall/issues/880 Broken Link
https://vuldb.com/?ctiid.285842 Permissions Required VDB Entry
https://vuldb.com/?id.285842 Third Party Advisory VDB Entry
https://vuldb.com/?submit.444666 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:macrozheng:mall:*:*:*:*:*:*:*:*
History

04 Sep 2025, 15:44

Type Values Removed Values Added
CPE cpe:2.3:a:macrozheng:mall:*:*:*:*:*:*:*:*
References () https://github.com/macrozheng/mall/issues/880 - () https://github.com/macrozheng/mall/issues/880 - Broken Link
References () https://vuldb.com/?ctiid.285842 - () https://vuldb.com/?ctiid.285842 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.285842 - () https://vuldb.com/?id.285842 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.444666 - () https://vuldb.com/?submit.444666 - Third Party Advisory, VDB Entry
First Time Macrozheng
Macrozheng mall
Summary
  • (es) Se ha encontrado una vulnerabilidad clasificada como problemática en macrozheng mall hasta la versión 1.0.3. Este problema afecta a una funcionalidad desconocida del componente JWT Token Handler. La manipulación lleva al uso de la clave criptográfica predeterminada. La complejidad de un ataque es bastante alta. Se sabe que la explotación es difícil. Se contactó al proveedor con anticipación sobre esta divulgación, pero no respondió de ninguna manera. En cambio, el problema publicado en GitHub se eliminó sin ninguna explicación.

22 Nov 2024, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-22 21:15

Updated : 2025-09-04 15:44

NVD link : CVE-2024-11619

Mitre link : CVE-2024-11619

CVE.ORG link : CVE-2024-11619

JSON object : View

Products Affected

macrozheng

  • mall
CWE
CWE-1394