CVE-2024-11619

Severity CVSS v4.0:

LOW

Type:

Unavailable / Other

Publication date:

22/11/2024

Last modified:

04/09/2025

Description

A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3. Affected by this issue is some unknown functionality of the component JWT Token Handler. The manipulation leads to use of default cryptographic key. The complexity of an attack is rather high. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way. Instead the issue posted on GitHub got deleted without any explanation.

Impact

Vector 4.0

CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS v4.0 Severity and Metrics:

Base Score: 2.30 LOW
Vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Attack Vector (AV): Adjacent
Attack Complexity (AC): High
Attack Requirements (AT): None
Privileges Required (PR): None
User Interaction (UI): None
Confidentiality (VC): Low
Integrity (VI): Low
Availability (VA): Low
Confidentiality (SC): None
Integrity (SI): None
Availability (SA): None

Base Score 4.0

2.30

Severity 4.0

LOW

Vector 3.x

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS v3.1 Severity and Metrics:

Base Score: 5.00 MEDIUM
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector (AV): Adjacent
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): Low
Integrity (I): Low
Availability (A): Low

Base Score 3.x

5.00

Severity 3.x

MEDIUM

Vector 2.0

AV:A/AC:H/Au:N/C:P/I:P/A:P CVSS v2.0 Severity and Metrics:

Base Score: 4.30 MEDIUM
Vector: AV:A/AC:H/Au:N/C:P/I:P/A:P

Attack Vector (AV): Adjacent
Attack Complexity (AC): High
Authentication (Au): None
Confidentiality (C): Physical
Integrity (I): Physical
Availability (A): Physical