Skip to main content

Bludit CVE-2024-24553

MEDIUM
Use of Password Hash With Insufficient Computational Effort (CWE-916)
2024-06-24 vulnerability@ncsc.ch
Information Disclosure Bludit
5.9
CVSS 4.0 · Vendor: ncsc
Share

Severity by source

Vendor (ncsc) PRIMARY
5.9 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (ncsc) · only source for this CVE.

CVSS VectorVendor: ncsc

CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

1
CVE Published
Jun 24, 2024 - 07:15 cve.org
MEDIUM 5.9

DescriptionCVE.org

Bludit uses the SHA-1 hashing algorithm to compute password hashes. Thus, attackers could determine cleartext passwords with brute-force attacks due to the inherent speed of SHA-1. In addition, the salt that is computed by Bludit is generated with a non-cryptographically secure function.

AnalysisAI

Bludit uses the SHA-1 hashing algorithm to compute password hashes. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-916. Bludit uses the SHA-1 hashing algorithm to compute password hashes. Thus, attackers could determine cleartext passwords with brute-force attacks due to the inherent speed of SHA-1. In addition, the salt that is computed by Bludit is generated with a non-cryptographically secure function. Affected products include: Bludit.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Bludit

View all
CVE-2019-16113 HIGH POC
8.8 Sep 08

Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .j
CVE-2019-17240 CRITICAL POC
9.8 Oct 06

bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many
CVE-2020-18190 CRITICAL POC
9.1 Oct 02

Bludit v3.8.1 is affected by directory traversal. Rated critical severity (CVSS 9.1), this vulnerability is remotely exp
CVE-2024-24551 HIGH POC
8.9 Jun 24

A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code throu
CVE-2024-24550 HIGH POC
8.9 Jun 24

A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arb
CVE-2023-31572 HIGH POC
8.8 May 16

An issue in Bludit 4.0.0-rc-2 allows authenticated attackers to change the Administrator password and escalate privilege
CVE-2018-1000811 HIGH POC
8.8 Dec 20

bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages
CVE-2023-24674 HIGH POC
7.8 Sep 01

Permissions vulnerability found in Bludit CMS v.4.0.0 allows local attackers to escalate privileges via the role:admin p
CVE-2021-25808 HIGH POC
7.8 Jul 23

A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a cr
CVE-2020-19228 HIGH POC
7.2 May 11

An issue was found in bludit v3.13.0, unsafe implementation of the backup plugin allows attackers to upload arbitrary fi
CVE-2021-35323 MEDIUM POC
6.1 Oct 19

Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login. Rated medium severity

CVE-2018-16313 MEDIUM POC
6.1 Sep 01

Bludit 2.3.4 allows XSS via a user name. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, n

Same weakness CWE-916 – Use of Password Hash With Insufficient Computational Effort

View all
CVE-2018-15680 CRITICAL POC
9.8
CVE-2018-10618 CRITICAL POC
9.8
CVE-2019-19735 CRITICAL POC
9.1
CVE-2022-1235 HIGH POC
8.2
CVE-2023-33243 HIGH POC
8.1
CVE-2018-9233 HIGH POC
7.8
CVE-2024-23091 HIGH POC
7.5
CVE-2021-33563 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2024-24553 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy