CVE-2024-11308 TRCore DVC - Use of Hard-coded Cryptographic Key
Attackers can decrypt files encrypted by TRCore DVC using a hardcoded cryptographic key, exposing original content.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-11308?
CVE-2024-11308 is a medium-severity vulnerability in TRCore DVC, published on 18 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The DVC from TRCore encrypts files using a hardcoded key. Attackers can use this key to decrypt the files and restore the original content.
Weakness: CWE-321
Which versions are affected by CVE-2024-11308?
It affects 1 product.
Products include Trcore Dvc.
How do I fix CVE-2024-11308?
No fix has been published for CVE-2024-11308 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-11308 being exploited?
There is no known exploitation of CVE-2024-11308 in the wild and no public exploit code.
Other vulnerabilities in TRCore DVC
- CVE-2024-11311 TRCore DVC - Arbitrary File Upload through Path Traversal
- CVE-2024-11312 TRCore DVC - Arbitrary File Upload through Path Traversal
- CVE-2024-11313 TRCore DVC - Arbitrary File Upload through Path Traversal
- CVE-2024-11314 TRCore DVC - Arbitrary File Upload through Path Traversal
- CVE-2024-11315 TRCore DVC - Arbitrary File Upload through Path Traversal
Sources
Also known as GHSA-w9wj-2hjp-gx85.