Vulnerability-Lookup

CVE-2024-1143 (GCVE-0-2024-1143)

Vulnerability from cvelistv5 – Published: 2024-02-02 06:01 – Updated: 2025-06-03 18:49

Summary

Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentication bypass.

Severity

9.3 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-02-02 19:51 UTC

CWE

na
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

LINE

References

1 reference

URL	Tags
https://github.com/line/centraldogma/security/adv…

Impacted products

1 product

Vendor	Product	Version	CPE status
LINE Corporation	Central Dogma	Affected: 0.63.3 , < 0.64.1 (semver)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1143",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-02T19:51:13.437915Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-03T18:49:03.700Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:26:30.469Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/line/centraldogma/security/advisories/GHSA-34q3-p352-c7q8"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Central Dogma",
          "vendor": "LINE Corporation",
          "versions": [
            {
              "lessThan": "0.64.1",
              "status": "affected",
              "version": "0.63.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentication bypass."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "na",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-06T06:59:56.850Z",
        "orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb",
        "shortName": "LINE"
      },
      "references": [
        {
          "url": "https://github.com/line/centraldogma/security/advisories/GHSA-34q3-p352-c7q8"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb",
    "assignerShortName": "LINE",
    "cveId": "CVE-2024-1143",
    "datePublished": "2024-02-02T06:01:39.341Z",
    "dateReserved": "2024-02-01T04:33:49.542Z",
    "dateUpdated": "2025-06-03T18:49:03.700Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-1143",
      "date": "2026-09-26",
      "epss": "0.00491",
      "percentile": "0.39715"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:linecorp:central_dogma:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "81505A16-D8BF-483C-BED9-59BABC8B62DA",
                  "versionEndExcluding": "0.64.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentication bypass."
        },
        {
          "lang": "es",
          "value": "Las versiones de Central Dogma anteriores a la 0.64.0 son vulnerables a Cross-Site Scripting (XSS), lo que podr\u00eda permitir la fuga de sesiones de usuario y la posterior omisi\u00f3n de autenticaci\u00f3n."
        }
      ],
      "id": "CVE-2024-1143",
      "lastModified": "2024-11-21T08:49:53.807",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.3,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 5.8,
            "source": "dl_cve@linecorp.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 2.7,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-02-02T06:15:45.360",
      "references": [
        {
          "source": "dl_cve@linecorp.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://github.com/line/centraldogma/security/advisories/GHSA-34q3-p352-c7q8"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://github.com/line/centraldogma/security/advisories/GHSA-34q3-p352-c7q8"
        }
      ],
      "sourceIdentifier": "dl_cve@linecorp.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-79"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "Central Dogma",
                "vendor": "LINE Corporation",
                "versions": [
                  {
                    "lessThan": "0.64.1",
                    "status": "affected",
                    "version": "0.63.3",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "dl_cve@linecorp.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:linecorp:central_dogma:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "81505A16-D8BF-483C-BED9-59BABC8B62DA",
                    "versionEndExcluding": "0.64.1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentication bypass."
          },
          {
            "lang": "es",
            "value": "Las versiones de Central Dogma anteriores a la 0.64.0 son vulnerables a Cross-Site Scripting (XSS), lo que podr\u00eda permitir la fuga de sesiones de usuario y la posterior omisi\u00f3n de autenticaci\u00f3n."
          }
        ],
        "id": "CVE-2024-1143",
        "lastModified": "2026-06-17T07:03:34.440",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.8,
              "source": "dl_cve@linecorp.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-1143",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-02T19:51:13.437915Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-02-02T06:15:45.360",
        "references": [
          {
            "source": "dl_cve@linecorp.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/line/centraldogma/security/advisories/GHSA-34q3-p352-c7q8"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/line/centraldogma/security/advisories/GHSA-34q3-p352-c7q8"
          }
        ],
        "sourceIdentifier": "dl_cve@linecorp.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T19:08:59+00:00",
      "cve": "CVE-2024-1143",
      "id": "CVE-2024-1143",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2024-1143",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-1143.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-01T18:26:30.469Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://github.com/line/centraldogma/security/advisories/GHSA-34q3-p352-c7q8"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-1143",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-02-02T19:51:13.437915Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-79",
                    "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-07-05T15:20:38.867Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "Central Dogma",
              "vendor": "LINE Corporation",
              "versions": [
                {
                  "lessThan": "0.64.1",
                  "status": "affected",
                  "version": "0.63.3",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentication bypass."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "na",
                  "lang": "en"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-02-06T06:59:56.850Z",
            "orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb",
            "shortName": "LINE"
          },
          "references": [
            {
              "url": "https://github.com/line/centraldogma/security/advisories/GHSA-34q3-p352-c7q8"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb",
        "assignerShortName": "LINE",
        "cveId": "CVE-2024-1143",
        "datePublished": "2024-02-02T06:01:39.341Z",
        "dateReserved": "2024-02-01T04:33:49.542Z",
        "dateUpdated": "2025-06-03T18:49:03.700Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-1143

Vulnerability from fkie_nvd - Published: 2024-02-02 06:15 - Updated: 2026-06-17 07:03

Severity

9.3 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentication bypass.

References

	URL	Tags
	dl_cve@linecorp.com	https://github.com/line/centraldogma/security/advisories/GHSA-34q3-p352-c7q8	Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/line/centraldogma/security/advisories/GHSA-34q3-p352-c7q8	Vendor Advisory

Impacted products

	Vendor	Product	Version
	linecorp	central_dogma	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Central Dogma",
          "vendor": "LINE Corporation",
          "versions": [
            {
              "lessThan": "0.64.1",
              "status": "affected",
              "version": "0.63.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "dl_cve@linecorp.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:linecorp:central_dogma:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "81505A16-D8BF-483C-BED9-59BABC8B62DA",
              "versionEndExcluding": "0.64.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentication bypass."
    },
    {
      "lang": "es",
      "value": "Las versiones de Central Dogma anteriores a la 0.64.0 son vulnerables a Cross-Site Scripting (XSS), lo que podr\u00eda permitir la fuga de sesiones de usuario y la posterior omisi\u00f3n de autenticaci\u00f3n."
    }
  ],
  "id": "CVE-2024-1143",
  "lastModified": "2026-06-17T07:03:34.440",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.8,
        "source": "dl_cve@linecorp.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-1143",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-02-02T19:51:13.437915Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-02-02T06:15:45.360",
  "references": [
    {
      "source": "dl_cve@linecorp.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/line/centraldogma/security/advisories/GHSA-34q3-p352-c7q8"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/line/centraldogma/security/advisories/GHSA-34q3-p352-c7q8"
    }
  ],
  "sourceIdentifier": "dl_cve@linecorp.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-34Q3-P352-C7Q8

Vulnerability from github – Published: 2024-02-02 16:55 – Updated: 2024-04-25 16:46

Summary

Central Dogma Authentication Bypass Vulnerability via Session Leakage

Details

Vulnerability Overview

A vulnerability has been identified in Central Dogma versions prior to 0.64.1, allowing for the leakage of user sessions and subsequent authentication bypass. The issue stems from a Cross-Site Scripting (XSS) attack vector that targets the RelayState of Security Assertion Markup Language (SAML).

Impact

Successful exploitation of this vulnerability enables malicious actors to leak user sessions, leading to the compromise of authentication mechanisms. This, in turn, can facilitate unauthorized access to sensitive resources.

Patches

This vulnerability is addressed and resolved in Central Dogma version 0.64.1 Users are strongly encouraged to upgrade to this version or later to mitigate the risk associated with the authentication bypass.

Workarounds

No viable workarounds are currently available for this vulnerability. It is recommended to apply the provided patch promptly.

References

Severity

9.3 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.linecorp.centraldogma:centraldogma-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.64.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-1143"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-02T16:55:25Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Vulnerability Overview\nA vulnerability has been identified in Central Dogma versions prior to 0.64.1, allowing for the leakage of user sessions and subsequent authentication bypass. The issue stems from a Cross-Site Scripting (XSS) attack vector that targets the RelayState of Security Assertion Markup Language (SAML).\n\n### Impact\nSuccessful exploitation of this vulnerability enables malicious actors to leak user sessions, leading to the compromise of authentication mechanisms. This, in turn, can facilitate unauthorized access to sensitive resources.\n\n### Patches\nThis vulnerability is addressed and resolved in Central Dogma version 0.64.1 Users are strongly encouraged to upgrade to this version or later to mitigate the risk associated with the authentication bypass.\n\n### Workarounds\nNo viable workarounds are currently available for this vulnerability. It is recommended to apply the provided patch promptly.\n\n### References\n- [OASIS SAML v2.0 Errata 05](https://docs.oasis-open.org/security/saml/v2.0/errata05/os/saml-v2.0-errata05-os.html#__RefHeading__8196_1983180497)\n- [OWASP XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#xss-defense-philosophy)",
  "id": "GHSA-34q3-p352-c7q8",
  "modified": "2024-04-25T16:46:07Z",
  "published": "2024-02-02T16:55:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/line/centraldogma/security/advisories/GHSA-34q3-p352-c7q8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1143"
    },
    {
      "type": "WEB",
      "url": "https://github.com/line/centraldogma/commit/8edcf913b88101aff70008156b0881850e005783"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/line/centraldogma"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Central Dogma Authentication Bypass Vulnerability via Session Leakage"
}

GHSA-QFV2-3P2F-VG48

Vulnerability from github – Published: 2024-02-02 06:30 – Updated: 2024-02-02 16:55

Withdrawn 2024-02-02

Summary

Duplicate Advisory: Central Dogma Authentication Bypass Vulnerability via Session Leakage

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-34q3-p352-c7q8. This link is maintained to preserve external references.

Original Description

Central Dogma versions prior to 0.64.0 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentication bypass.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.linecorp.centraldogma:centraldogma-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.64.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-02T16:55:20Z",
    "nvd_published_at": "2024-02-02T06:15:45Z",
    "severity": "MODERATE"
  },
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-34q3-p352-c7q8. This link is maintained to preserve external references.\n\n## Original Description\nCentral Dogma versions prior to 0.64.0 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentication bypass.",
  "id": "GHSA-qfv2-3p2f-vg48",
  "modified": "2024-02-02T16:55:20Z",
  "published": "2024-02-02T06:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1143"
    },
    {
      "type": "WEB",
      "url": "https://github.com/line/centraldogma/commit/8edcf913b88101aff70008156b0881850e005783"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Duplicate Advisory: Central Dogma Authentication Bypass Vulnerability via Session Leakage",
  "withdrawn": "2024-02-02T16:55:20Z"
}

GSD-2024-1143

Vulnerability from gsd - Updated: 2024-02-01 06:02

Details

Central Dogma versions prior to 0.64.0 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentication bypass.

Aliases

CVE-2024-1143

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-1143"
      ],
      "details": "Central Dogma versions prior to 0.64.0 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentication bypass.",
      "id": "GSD-2024-1143",
      "modified": "2024-02-01T06:02:23.377503Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "dl_cve@linecorp.com",
        "ID": "CVE-2024-1143",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Central Dogma",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "0.63.3",
                          "version_value": "0.64.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "LINE Corporation"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentication bypass."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "na"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/line/centraldogma/security/advisories/GHSA-34q3-p352-c7q8",
            "refsource": "MISC",
            "url": "https://github.com/line/centraldogma/security/advisories/GHSA-34q3-p352-c7q8"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:linecorp:central_dogma:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "81505A16-D8BF-483C-BED9-59BABC8B62DA",
                    "versionEndExcluding": "0.64.1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentication bypass."
          },
          {
            "lang": "es",
            "value": "Las versiones de Central Dogma anteriores a la 0.64.0 son vulnerables a Cross-Site Scripting (XSS), lo que podr\u00eda permitir la fuga de sesiones de usuario y la posterior omisi\u00f3n de autenticaci\u00f3n."
          }
        ],
        "id": "CVE-2024-1143",
        "lastModified": "2024-02-09T19:08:27.423",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.8,
              "source": "dl_cve@linecorp.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-02-02T06:15:45.360",
        "references": [
          {
            "source": "dl_cve@linecorp.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/line/centraldogma/security/advisories/GHSA-34q3-p352-c7q8"
          }
        ],
        "sourceIdentifier": "dl_cve@linecorp.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

JVNDB-2024-002342

Vulnerability from jvndb - Published: 2024-05-13 08:27 - Updated:2024-05-13 08:27

Severity

9.3 (Critical) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Summary

Central Dogma vulnerable to cross-site scripting

Details

Central Dogma provided by LY Corporation contains a cross-site scripting vulnerability (CWE-79, CVE-2024-1143) because RelayState data is not properly treated when Central Dogma processes SAML messages. LY Corporation reported this vulnerability to JPCERT/CC to notify users of its solution through JVN.

References

Type

URL

	JVN	https://jvn.jp/en/vu/JVNVU99669446/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-1143
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2024-1143
	Related document	https://docs.oasis-open.org/security/saml/v2.0/errata05/os/saml-v2.0-errata05-os.html#__RefHeading__8196_1983180497
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

LY Corporation

Central Dogma

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-002342.html",
  "dc:date": "2024-05-13T17:27+09:00",
  "dcterms:issued": "2024-05-13T17:27+09:00",
  "dcterms:modified": "2024-05-13T17:27+09:00",
  "description": "Central Dogma provided by LY Corporation contains a cross-site scripting vulnerability (CWE-79, CVE-2024-1143) because RelayState data is not properly treated when Central Dogma processes SAML messages.\r\n\r\nLY Corporation reported this vulnerability to JPCERT/CC to notify users of its solution through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-002342.html",
  "sec:cpe": {
    "#text": "cpe:/a:linecorp:central_dogma",
    "@product": "Central Dogma",
    "@vendor": "LY Corporation",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "9.3",
    "@severity": "Critical",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-002342",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU99669446/index.html",
      "@id": "JVNVU#99669446",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-1143",
      "@id": "CVE-2024-1143",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2024-1143",
      "@id": "CVE-2024-1143",
      "@source": "NVD"
    },
    {
      "#text": "https://docs.oasis-open.org/security/saml/v2.0/errata05/os/saml-v2.0-errata05-os.html#__RefHeading__8196_1983180497",
      "@id": "SAML v2.0 Errata 05, E90: RelayState sanitization",
      "@source": "Related document"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Central Dogma vulnerable to cross-site scripting"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-1143 (GCVE-0-2024-1143)

FKIE_CVE-2024-1143

GHSA-34Q3-P352-C7Q8

Vulnerability Overview

Impact

Patches

Workarounds

References

GHSA-QFV2-3P2F-VG48

Duplicate Advisory

Original Description

GSD-2024-1143

JVNDB-2024-002342

Tags

Sightings

Nomenclature

Related by attack behaviour