CVE-2024-39314 toy-blog administrative token leaked through the command line parameter
Attackers can read the administrative password from command line parameters, leading to unauthorized access and potential account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-39314?
CVE-2024-39314 is a medium-severity vulnerability in KisaragiEffective toy-blog, published on 1 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked through the command line parameter. The problem was patched in version 0.5.0. As a workaround, pass `--read-bearer-token-from-stdin` to the launch arguments and feed the token from the standard input in version 0.4.14 or later. Earlier versions do not have this workaround.
Which versions are affected by CVE-2024-39314?
How do I fix CVE-2024-39314?
No fix has been published for CVE-2024-39314 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-39314 being exploited?
There is no known exploitation of CVE-2024-39314 in the wild and no public exploit code.
Sources
Also known as GHSA-q8g2-c3x5-gp89.