CVE-2024-45391

HIGH

Tina CMS < 1.6.2 - Search Token Exposure via Lock File

Title source: llm
STIX 2.1

Description

Tina is an open-source content management system (CMS). Sites building with Tina CMS's command line interface (CLI) prior to version 1.6.2 that use a search token may be vulnerable to the search token being leaked via lock file (tina-lock.json). Administrators of Tina-enabled websites with search setup should rotate their key immediately. This issue has been patched in @tinacms/cli version 1.6.2. Upgrading and rotating the search token is required for the proper fix.

References (3)

Core 3

Scores

CVSS v3 7.5
EPSS 0.0031
EPSS Percentile 22.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-200 CWE-312
Status published
Products (3)
ssw/tinacms\/cli < 1.6.2
tina/tina < 1.6.2
tinacms/cli 0 - 1.6.2npm
Published Sep 03, 2024
Tracked Since Feb 18, 2026