CVE-2024-45793

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-45793
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45793.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-45793
Aliases
Published
2024-09-20T19:07:27.802Z
Modified
2026-04-10T05:17:52.000494Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Cross-site Scripting from in Confidant API call
Details

Confidant is a open source secret management service that provides user-friendly storage and access to secrets. The following endpoints are subject to a cross site scripting vulnerability: GET /v1/credentials, GET /v1/credentials/, GET /v1/archive/credentials/, GET /v1/archive/credentials, POST /v1/credentials, PUT /v1/credentials/, PUT /v1/credentials//<to_revision>, GET /v1/services, GET /v1/services/, GET /v1/archive/services/, GET /v1/archive/services, PUT /v1/services/, PUT /v1/services//<to_revision>. The attacker needs to be authenticated and have privileges to create new credentials, but could use this to show information and run scripts to other users into the same Confidant instance. This issue has been patched in version 6.6.2. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45793.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/lyft/confidant

Affected ranges

Type
GIT
Repo
https://github.com/lyft/confidant
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8876b07abde0c8d2a4974f79b60562b6d0193db9
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.6.2"
        }
    ]
}

Affected versions

1.*
1.1.19
1.1.20
1.1.21
1.10.0
1.10.1
1.11.0
1.2.0
1.3.0
1.4.0
1.5.0
1.5.1
1.6.0
1.8.0
1.9.0
3.*
3.0.0
4.*
4.0.0
4.1.0
4.2.0
4.3.0
4.3.1
4.4.0
5.*
5.0.0
5.0.1
5.1.0
5.2.0
6.*
6.0.0
6.1.0
6.3.0
6.4.0
6.5.0
6.5.1
6.5.2
6.5.3
6.5.4
6.6.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45793.json"