CVE-2024-10920

CVSS V2 None CVSS V3 None
Description
A vulnerability was found in mariazevedo88 travels-java-api up to 5.0.1 and classified as problematic. Affected by this issue is the function doFilterInternal of the file travels-java-api-master\src\main\java\io\github\mariazevedo88\travelsjavaapi\filters\JwtAuthenticationTokenFilter.java of the component JWT Secret Handler. The manipulation leads to use of hard-coded cryptographic key . The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
Overview
  • CVE ID
  • CVE-2024-10920
  • Assigner
  • VulDB
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-11-06T16:00:09.086Z
  • Last Modified Date
  • 2024-11-06T16:09:49.168Z
Weakness Enumerations
CWE URL
CWE-321 http://cwe.mitre.org/data/definitions/321.html
CWE-320 http://cwe.mitre.org/data/definitions/320.html
References
Reference URL Reference Tags
https://vuldb.com/?id.283316 vdb-entry technical-description
https://vuldb.com/?ctiid.283316 signature permissions-required
https://vuldb.com/?submit.433458 third-party-advisory
https://github.com/mariazevedo88/travels-java-api/issues/23 exploit issue-tracking
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2024-10920
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10920
History
Created Old Value New Value Data Type Notes
2024-11-07 13:14:07 Added to TrackCVE