Vulnerability · Published Aug 29, 2024 · Assigned by VulDB

CVE-2024-8297kitsada8621 Digital Library Management System jwt_refresh_token_middleware.go JwtRefreshAuth neutralization for logs

Medium 5.3

In plain English

A medium-severity security flaw in Digital Library Management System from kitsada8621. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 54.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in kitsada8621 Digital Library Management System 1.0. It has been classified as problematic. Affected is the function JwtRefreshAuth of the file middleware/jwt_refresh_token_middleware.go. The manipulation of the argument Authorization leads to improper output neutralization for logs. It is possible to launch the attack remotely. The name of the patch is 81b3336b4c9240f0bf50c13cb8375cf860d945f1. It is recommended to apply a patch to fix this issue.

Affected products (as reported)

Vendor	Product	Versions
kitsada8621	Digital Library Management System	1.0

Weakness: CWE-117 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

VDB-276072 | kitsada8621 Digital Library Management System jwt_refresh_token_middleware.go JwtRefreshAuth neutralization for logs vdb-entry, technical-description
VDB-276072 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #394613 | kitsada8621 Digital-Library-Management-System 1.0 Improper Output Neutralization for Logs third-party-advisory
https://github.com/kitsada8621/Digital-Library-Management-System/issues/1 issue-tracking
https://github.com/kitsada8621/Digital-Library-Management-System/commit/81b3336b4c9240f0bf50c13cb8375cf860d945f1 patch