What is CVE-2024-34695?

CVE-2024-34695 is a medium-severity vulnerability in Sakuraisayeki Wows-Karma, classified under CWE-799. CVSS score: 6.3/10. Published 2024-05-14.

How severe is CVE-2024-34695?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Vulnerability in Sakuraisayeki Wows-Karma

CVE-2024-34695

WOWS Karma is a reputation system for Wargaming's World of Warships. A user is able to click multiple times on "create" on a post creation prompt before the modal closes, which triggers sending several post creation API requests at once. Due to timing, sending multiple posts simultaneously requests bypasses the cooldown validation, however are not refreshing a user's metrics more than once, due to concurrent karma updates. This issue is fixed in 0.17.4.1.

EPSS: 0.008 (51.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H.

Affected products

Sakuraisayeki Wows-karma — versions <= 0.17.4

Weakness classification (CWE)

CWE-799

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2024-34695?: CVE-2024-34695 is a medium-severity vulnerability in Sakuraisayeki Wows-Karma, classified under CWE-799. CVSS score: 6.3/10. Published 2024-05-14.
How severe is CVE-2024-34695?: Medium severity. CVSS v3 base score is 6.3 out of 10.