CVE-2024-24552

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or any other user into authorizing a session ID of their choosing.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-384

Affected software

Vendor	Product	Versions
Bludit	Bludit	0
bludit	bludit	<= 3.15.0

References

https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/Third Party Advisory
https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/Third Party Advisory

Timeline

Published: Jun 24, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-245537.5Bludit uses the SHA-1 hashing algorithm to compute password hashes. Thus, attackers could determine cleartext passwords with brute-force att CVE-2024-245548.2Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the use CVE-2024-245566.1urql is a GraphQL client that exposes a set of helpers for several frameworks. The `@urql/next` package is vulnerable to XSS. To exploit th CVE-2024-245577.8Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poi CVE-2024-245586.1TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The `@tanstack/react-query-nex CVE-2024-245595.3Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the `IR` for `sha3_64`. Co CVE-2024-24566.4The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all ver CVE-2024-245605.3Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. When calls to external contracts are made, we write the input CVE-2024-245619.8Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.10 and earlier, the bounds check for slices do CVE-2024-245625.3vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issu CVE-2024-245639.8Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. Arrays can be keyed by a signed integer, while they are define CVE-2024-245645.3Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start`