{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2024-34354 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2024-34354 yet. Limit exposure of the affected software until one is available.","what":"CVE-2024-34354 is a medium-severity authentication bypass vulnerability in CriticalMoments CMSaasStarter, published on 9 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-34354 and fix it if it is affected.\n\nWhat it is: CVE-2024-34354 is a medium-severity authentication bypass vulnerability in CriticalMoments CMSaasStarter, published on 9 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-34354 in the wild and no public exploit code.\n\nAffected product: CriticalMoments CMSaasStarter. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-34354/ (Markdown: https://insights.sbomify.com/CVE-2024-34354/index.md)","id":"CVE-2024-34354","markdown":"https://insights.sbomify.com/CVE-2024-34354/index.md","name":"CVE-2024-34354","record":{"aliases":["GHSA-qgcj-9rxf-rw7q"],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["privilege_escalation","data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"SaaS starter template","requires_auth":"none","summary":"Attackers can bypass authentication in CMSaasStarter forks because server sessions do not verify JWT tokens, allowing unauthorized access to protected resources.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":6.5,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-345","name":"Insufficient Verification of Data Authenticity"}],"description":"CMSaaSStarter is a SaaS template/boilerplate built with SvelteKit, Tailwind, and Supabase. Any forks of the CMSaaSStarter template before commit 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 are impacted. The issue is the user JWT Token is not verified on server session. You should take the patch 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 into your fork.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"CMSaasStarter: JWT Token Not Verified on Server Session","id":"CVE-2024-34354","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"auth_bypass","year":"2024"},"n_packages":0,"n_references":3,"next":{"headline":"TYPO3 vulnerable to an HTML Injection in the History Module","id":"CVE-2024-34355"},"packages":[],"prev":{"headline":"matrix-sdk-crypto contains a log exposure of private key of the server-side key backup","id":"CVE-2024-34353"},"products":["CMSaasStarter"],"published":"2024-05-09","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-08-02","vendors":["CriticalMoments"]},"summary":"Attackers can bypass authentication in CMSaasStarter forks because server sessions do not verify JWT tokens, allowing unauthorized access to protected resources.","url":"https://insights.sbomify.com/CVE-2024-34354/"}