What is CVE-2024-34354?

CVE-2024-34354 is a medium-severity vulnerability in Criticalmoments Cmsaasstarter, classified under Insufficient Verification of Data Authenticity. CVSS score: 6.5/10. Published 2024-05-14.

How severe is CVE-2024-34354?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Criticalmoments Cmsaasstarter

CVE-2024-34354

CMSaaSStarter is a SaaS template/boilerplate built with SvelteKit, Tailwind, and Supabase. Any forks of the CMSaaSStarter template before commit 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 are impacted. The issue is the user JWT Token is not verified on server session. You should take the patch 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 into your fork.

EPSS: 0.003 (21.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.

Affected products

Criticalmoments Cmsaasstarter — versions < 7904d416d2c72ec75f42fbf51e9e64fa74062ee6

Weakness classification (CWE)

CWE-345 — Insufficient Verification of Data Authenticity

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2024-34354?: CVE-2024-34354 is a medium-severity vulnerability in Criticalmoments Cmsaasstarter, classified under Insufficient Verification of Data Authenticity. CVSS score: 6.5/10. Published 2024-05-14.
How severe is CVE-2024-34354?: Medium severity. CVSS v3 base score is 6.5 out of 10.