arpsyndicate/puncia · Security
[PUNCIA] [CWE-319] Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS`
- GHSA ID
- GHSA-rwcj-7jjp-4w38
- CVE ID
- CVE-2024-41124
- Severity
- low
- Published
- Updated
- CVSS
- 3.8 · CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
- CVSS v3
- 3.8 · CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
- CVSS v4
- 2.1 · CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Description
Impact
API_URLS is utilizing HTTP instead of HTTPS for communication that can lead to issues like Eavesdropping, Data Tampering, Unauthorized Data Access & MITM Attacks.
References
CWEs
- CWE-311 · Missing Encryption of Sensitive Data
- CWE-319 · Cleartext Transmission of Sensitive Information
References
- https://github.com/ARPSyndicate/puncia/security/advisories/GHSA-rwcj-7jjp-4w38 ↗
- https://github.com/ARPSyndicate/puncia/issues/8 ↗
- https://github.com/ARPSyndicate/puncia/commit/033f3b68126eabbb2040ce16e2c3a2ce17437fbd ↗
- https://nvd.nist.gov/vuln/detail/CVE-2024-41124 ↗
- https://github.com/ARPSyndicate/puncia/commit/033f3b68126eabbb2040ce16e2c3a2ce17437fbd#diff-3ec6c2de51e702726b23c452e3f4a899f6f4253af9fbf5be7254a5c1407ab526 ↗
- https://github.com/advisories/GHSA-rwcj-7jjp-4w38 ↗