CVE-2024-8135

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-8135

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-8135.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-8135

Published

2024-08-24T21:31:04.333Z

Modified

2026-07-15T01:49:08.787794012Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Go-Tribe gotribe token.go Sign hard-coded credentials

Details

A vulnerability classified as critical has been found in Go-Tribe gotribe up to cd3ccd32cd77852c9ea73f986eaf8c301cfb6310. Affected is the function Sign of the file pkg/token/token.go. The manipulation of the argument config.key leads to hard-coded credentials. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as 4fb9b9e80a2beedd09d9fde4b9cf5bd510baf18f. It is recommended to apply a patch to fix this issue.

Database specific

{
    "cna_assigner": "VulDB",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "cd3ccd32cd77852c9ea73f986eaf8c301cfb6310"
                },
                {
                    "last_affected": "cd3ccd32cd77852c9ea73f986eaf8c301cfb6310"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/8xxx/CVE-2024-8135.json",
    "cwe_ids": [
        "CWE-798"
    ]
}

References

Affected packages

Git / github.com/go-tribe/gotribe

Affected ranges

Type

GIT

Repo

https://github.com/go-tribe/gotribe

Events

Introduced

Fixed

4fb9b9e80a2beedd09d9fde4b9cf5bd510baf18f

Database specific

{
    "source": "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-8135.json"