CVE-2024-25190

CVSS 3.1 Score 9.8 of 10 (high)

Details

Published Feb 8, 2024
Updated: Feb 15, 2024
CWE ID 203

Summary

CVE-2024-25190 is a critical vulnerability that affects l8w8jwt 2.2.1, allowing for bypassing of authentication through a timing side channel due to the use of memcmp, which is not constant time. The vulnerability has a CVSS v3.1 base score of 9.8, indicating its high severity. It poses a significant danger to organizations as it has a high impact on both confidentiality and integrity of the affected products. The exploitability score is 3.9, suggesting that it is relatively easy to exploit without requiring any special privileges or user interaction. The attack vector is through the network, and the availability impact is also high. To remediate this vulnerability, it is recommended to update l8w8jwt to a version that addresses the issue and uses constant time verification methods for authentication.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-25190 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options