CVE-2024-34695CWE-799

WOWS Karma vulnerable to a post submission bounce/timing attack

Medium · published May 10, 2024

CVSS v3.1
6.3
EPSS
1%
Percentile
55.0
In the wild
Unconfirmed
What it is

WOWS Karma is a reputation system for Wargaming's World of Warships. A user is able to click multiple times on "create" on a post creation prompt before the modal closes, which triggers sending several post creation API requests at once. Due to timing, sending multiple posts simultaneously requests bypasses the cooldown validation, however are not refreshing a user's metrics more than once, due to concurrent karma updates. This issue is fixed in 0.17.4.1.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00765 · 55.0th percentile
Weakness
CWE-799 · Improper Control of Interaction Frequency
Published
2024-05-10T15:57Z
EPSS history
Timeline
  • 10 MAY 15:57Z
    WOWS Karma vulnerable to a post submission bounce/timing attack
    cvelistv5