CVE-2024-41290 Information disclosure in n/a
Attackers can potentially steal authentication data from insecurely stored cookies, leading to account takeover in FlatPress CMS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-41290?
CVE-2024-41290 is a high-severity vulnerability in n/a, published on 2 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component.
Weakness: CWE-315
Which versions are affected by CVE-2024-41290?
It affects 1 product.
Products include Flatpress Flatpress.
How do I fix CVE-2024-41290?
No fix has been published for CVE-2024-41290 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-41290 being exploited?
There is no known exploitation of CVE-2024-41290 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2022-4606 PHP Remote File Inclusion in flatpressblog/flatpress
- CVE-2020-22761 Cross-site request forgery in n/a
- CVE-2024-4023 Stored XSS in flatpressblog/flatpress
- CVE-2023-1104 Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress
- CVE-2023-0947 Path Traversal in flatpressblog/flatpress
Sources
Also known as GHSA-2m84-36h6-49q2.