CVE-2024-41962

Опубликовано: 01 авг. 2024

Источник: nvd

CVSS3: 4.6

CVSS3: 6.3

EPSS Низкий

Описание

Bostr is an nostr relay aggregator proxy that acts like a regular nostr relay. bostr let everyone in even having authorized_keys being set when noscraper is set to true. This vulnerability is fixed in 3.0.10.

Ссылки

https://github.com/Yonle/bostr/blob/8665374a66e2afb9f92d0414b0d6f420a95d5d2d/auth.js#L21
Product
https://github.com/Yonle/bostr/commit/49181f4ec9ae1472c6675cab56bbc01e723855af
Patch
https://github.com/Yonle/bostr/releases/tag/3.0.10
Release Notes
https://github.com/Yonle/bostr/security/advisories/GHSA-5cf7-cxrf-mq73
Mitigation
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:yonle:bostr:*:*:*:*:*:*:*:*

Версия до 3.0.10 (исключая)

EPSS

Процентиль: 44%

0.00212

Низкий

4.6 Medium

CVSS3

6.3 Medium

CVSS3

Дефекты

CWE-285

NVD-CWE-Other

Связанные уязвимости

GHSA-5cf7-cxrf-mq73

CVSS3: 4.6

github

больше 1 года назад

Bostr Improper Authorization vulnerability

EPSS

Процентиль: 44%

0.00212

Низкий

4.6 Medium

CVSS3

6.3 Medium

CVSS3

Дефекты

CWE-285

NVD-CWE-Other