CVE-2024-39314

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-39314
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-39314.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-39314
Aliases
  • GHSA-q8g2-c3x5-gp89
Published
2024-07-01T21:33:54Z
Modified
2025-12-01T04:24:19.793712Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
toy-blog administrative token leaked through the command line parameter
Details

toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked through the command line parameter. The problem was patched in version 0.5.0. As a workaround, pass --read-bearer-token-from-stdin to the launch arguments and feed the token from the standard input in version 0.4.14 or later. Earlier versions do not have this workaround.

Database specific 
{
    "cwe_ids": [
        "CWE-200",
        "CWE-214"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39314.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/kisaragieffective/toy-blog

Affected ranges

Type
GIT
Repo
https://github.com/kisaragieffective/toy-blog
Events
Introduced
65f3c33783219fcd9ae63ad3ee70a2bed47897a5
Fixed
7083b914f6eb6b558a6bbc607e53021dec8e495d

Affected versions

0.*
0.4.10
0.4.11
0.4.12
0.4.13
0.4.14
0.4.15
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-39314.json"