Vulnerability in Go-Tribe Gotribe
CVE-2024-8135
A vulnerability classified as critical has been found in Go-Tribe gotribe up to cd3ccd32cd77852c9ea73f986eaf8c301cfb6310. Affected is the function Sign of the file pkg/token/token.go. The manipulation of the argument config.key leads to hard-coded credentials. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as 4fb9b9e80a2beedd09d9fde4b9cf5bd510baf18f. It is recommended to apply a patch to fix this issue.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.005 (43.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 44th percentile — 43.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Go-Tribe Gotribe — versions cd3ccd32cd77852c9ea73f986eaf8c301cfb6310
- Gotribe
Weakness classification (CWE)
References
- vuldb.com/ (Permissions Required, technical-description, VDB Entry, vdb-entry)
- vuldb.com/ (signature, Permissions Required, permissions-required, VDB Entry)
- vuldb.com/ (VDB Entry, Third Party Advisory, third-party-advisory)
- github.com/Go-Tribe/gotribe/issues/1 (issue-tracking, Issue Tracking)
- github.com/Go-Tribe/gotribe/issues/1 (issue-tracking, Issue Tracking)
- github.com/Go-Tribe/gotribe/commit/4fb9b9e80a2beedd09d9fde4b9cf5bd510baf18f (Patch, patch)
Frequently asked questions
- What is CVE-2024-8135?
- CVE-2024-8135 is a medium-severity vulnerability in Go-Tribe Gotribe, classified under Use of Hard-coded Credentials. CVSS score: 6.3/10. Published 2024-08-24.
- How severe is CVE-2024-8135?
- Medium severity. CVSS v3 base score is 6.3 out of 10.