CVE-2024-39314

MEDIUM

toy-blog administrative token leaked through the command line parameter

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-39314 has a selected CVSS score of 4.7 (medium).

Description

toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked through the command line parameter. The problem was patched in version 0.5.0. As a workaround, pass `--read-bearer-token-from-stdin` to the launch arguments and feed the token from the standard input in version 0.4.14 or later. Earlier versions do not have this workaround.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 2, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

toy-blog

Browse KisaragiEffective / toy-blog
CVE List>= 0.4.3, < 0.5.0affected

References

2