CVE-2024-39314 - CVE House
Back to Database
Status published Medium CVE-2024-39314

toy-blog administrative token leaked through the command line parameter

Vulnerability Description

toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked through the command line parameter. The problem was patched in version 0.5.0. As a workaround, pass `--read-bearer-token-from-stdin` to the launch arguments and feed the token from the standard input in version 0.4.14 or later. Earlier versions do not have this workaround.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-39314

Credits & Attribution

No credits recorded in the NVD database.

References

More from KisaragiEffective

View All →
CVE-2024-39313
toy-blog Improper Input Validation vulnerability
Medium 6.5

Affected Vendor

KisaragiEffective

View all reports →

Affected Software

toy-blog
Vulnerable Versions:
>= 0.4.3, < 0.5.0

Timeline

Official Publish: July 1st, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-214 CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration