Mall
CVE-2024-11619
LOW
Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (vuldb) · only source for this CVE.
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3. Affected by this issue is some unknown functionality of the component JWT Token Handler. The manipulation leads to use of default cryptographic key. The complexity of an attack is rather high. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way. Instead the issue posted on GitHub got deleted without any explanation.
AnalysisAI
A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3. Rated low severity (CVSS 2.3), this vulnerability is no authentication required. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-1394. A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3. Affected by this issue is some unknown functionality of the component JWT Token Handler. The manipulation leads to use of default cryptographic key. The complexity of an attack is rather high. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way. Instead the issue posted on GitHub got deleted without any explanation. Affected products include: Macrozheng Mall. Version information: up to 1.0.3..
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
macrozheng mall e-commerce platform v1.0.3 has an authentication vulnerability in password reset enabling unauthorized a
Weak password recovery in macrozheng mall (commit 0504e86) exposes the /sso/getAuthCode endpoint of the mall-portal modu
A vulnerability classified as critical was found in Weitong Mall 1.0.0. Rated medium severity (CVSS 6.9), this vulnerabi
A vulnerability classified as critical has been found in Weitong Mall 1.0.0. Rated medium severity (CVSS 6.9), this vuln
A vulnerability was found in macrozheng mall up to 1.0.3. Rated medium severity (CVSS 6.3), this vulnerability is remote
A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.3), thi
A vulnerability was detected in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulne
A security vulnerability has been detected in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.
A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vul
Improper authorization in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to modify member add
A vulnerability was detected in macrozheng mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is rem
A vulnerability has been found in macrozheng mall up to 1.0.3. Rated medium severity (CVSS 5.3), this vulnerability is r
Same weakness CWE-1394 – Use of Default Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today