Vulnerability · Published May 9, 2024 · Assigned by GitHub_M

CVE-2024-34354CMSaasStarter: JWT Token Not Verified on Server Session

Medium 6.5

In plain English

A medium-severity insufficient verification of data authenticity in CMSaasStarter from CriticalMoments. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 78.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CMSaaSStarter is a SaaS template/boilerplate built with SvelteKit, Tailwind, and Supabase. Any forks of the CMSaaSStarter template before commit 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 are impacted. The issue is the user JWT Token is not verified on server session. You should take the patch 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 into your fork.

Affected products (as reported)

Vendor	Product	Versions
CriticalMoments	CMSaasStarter	< 7904d416d2c72ec75f42fbf51e9e64fa74062ee6

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/CriticalMoments/CMSaasStarter/security/advisories/GHSA-qgcj-9rxf-rw7q x_refsource_CONFIRM
https://github.com/CriticalMoments/CMSaasStarter/pull/65 x_refsource_MISC
https://github.com/CriticalMoments/CMSaasStarter/commit/7904d416d2c72ec75f42fbf51e9e64fa74062ee6 x_refsource_MISC