CVE-2024-8135

MEDIUM

gotribe < 2024-08-23 - Use of Hard-coded Credentials in Sign Function

Title source: llm
STIX 2.1

Description

A vulnerability classified as critical has been found in Go-Tribe gotribe up to cd3ccd32cd77852c9ea73f986eaf8c301cfb6310. Affected is the function Sign of the file pkg/token/token.go. The manipulation of the argument config.key leads to hard-coded credentials. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as 4fb9b9e80a2beedd09d9fde4b9cf5bd510baf18f. It is recommended to apply a patch to fix this issue.

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.396310
Issue Tracking issue-tracking
https://github.com/Go-Tribe/gotribe/issues/1
Permissions Required, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.275706
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.275706

Scores

CVSS v3 6.3
EPSS 0.0055
EPSS Percentile 41.4%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-798
Status published
Products (1)
gotribe/gotribe < 2024-08-23
Published Aug 24, 2024
Tracked Since Feb 18, 2026