CVE-2024-8135 Go-Tribe gotribe token.go Sign hard-coded credentials
Hard-coded credentials in the Sign function allow attackers to bypass security controls in the Go-Tribe gotribe library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-8135?
CVE-2024-8135 is a medium-severity vulnerability in Go-Tribe gotribe, published on 24 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability classified as critical has been found in Go-Tribe gotribe up to cd3ccd32cd77852c9ea73f986eaf8c301cfb6310. Affected is the function Sign of the file pkg/token/token.go. The manipulation of the argument config.key leads to hard-coded credentials. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as 4fb9b9e80a2beedd09d9fde4b9cf5bd510baf18f. It is recommended to apply a patch to fix this issue.
Weakness: CWE-798
Which versions are affected by CVE-2024-8135?
It affects 1 product.
Products include Gotribe Gotribe.
How do I fix CVE-2024-8135?
No fix has been published for CVE-2024-8135 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-8135 being exploited?
There is no known exploitation of CVE-2024-8135 in the wild and no public exploit code.
Sources
Also known as GHSA-q7qh-f4pw-5h53.