CVE-2024-12039
CVSS 3.0 Score 7.4 of 10 (high)
Details
Published Mar 20, 2025
CWE ID 307
Summary
CVE-2024-12039 is a vulnerability affecting langgenius/dify version v0.10.1. This issue allows unauthenticated attackers to attempt an unlimited number of code guesses for password resets. Consequently, an attacker can reset owner, admin, or other user passwords within a few hours, leading to a complete compromise of the application by gaining unauthorized access.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Dify