CVE-2024-45793

Confidant is a open source secret management service that provides user-friendly storage and access to secrets. The following endpoints are subject to a cross site scripting vulnerability: GET /v1/credentials, GET /v1/credentials/, GET /v1/archive/credentials/, GET /v1/archive/credentials, POST /v1/credentials, PUT /v1/credentials/, PUT /v1/credentials//<to_revision>, GET /v1/services, GET /v1/services/, GET /v1/archive/services/, GET /v1/archive/services, PUT /v1/services/, PUT /v1/services//<to_revision>. The attacker needs to be authenticated and have privileges to create new credentials, but could use this to show information and run scripts to other users into the same Confidant instance. This issue has been patched in version 6.6.2. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Configurations

No configuration.

History

26 Sep 2024, 13:32

Type Values Removed Values Added
Summary
  • (es) Confidant es un servicio de gestión de secretos de código abierto que proporciona almacenamiento y acceso a secretos de forma sencilla. Los siguientes endpoints están sujetos a una vulnerabilidad de cross site scripting: GET /v1/credentials, GET /v1/credentials/, GET /v1/archive/credentials/, GET /v1/archive/credentials, POST /v1/credentials, PUT /v1/credentials/, PUT /v1/credentials//, GET /v1/services, GET /v1/services/, GET /v1/archive/services/, GET /v1/archive/services, PUT /v1/services/, PUT /v1/services//. El atacante debe estar autenticado y tener privilegios para crear nuevas credenciales, pero podría utilizar esto para mostrar información y ejecutar secuencias de comandos a otros usuarios en la misma instancia de Confidant. Este problema se ha corregido en la versión 6.6.2. Se recomienda a todos los usuarios que actualicen la versión. No existen workarounds para esta vulnerabilidad.

20 Sep 2024, 20:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-09-20 20:15

Updated : 2024-09-26 13:32


NVD link : CVE-2024-45793

Mitre link : CVE-2024-45793

CVE.ORG link : CVE-2024-45793


JSON object : View

Products Affected

No product.

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')