CVE-2024-39314CWE-200CWE-214

toy-blog administrative token leaked through the command line parameter

Medium · published July 1, 2024

CVSS v3.1
4.7
EPSS
0%
Percentile
8.2
In the wild
Unconfirmed
What it is

toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked through the command line parameter. The problem was patched in version 0.5.0. As a workaround, pass `--read-bearer-token-from-stdin` to the launch arguments and feed the token from the standard input in version 0.4.14 or later. Earlier versions do not have this workaround.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00190 · 8.2th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-214 · Invocation of Process Using Visible Sensitive Information
Published
2024-07-01T21:33Z
EPSS history
Timeline
  • 01 JUL 21:33Z
    toy-blog administrative token leaked through the command line parameter
    cvelistv5