CVE-2024-29887

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the `serverpod_client` package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device and the server. An attacker would need to be able to intercept the traffic and highjack the connection to the server for this vulnerability to be used. Upgrading to version `1.2.6` resolves this issue.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published: Mar 27, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-298885.4Saleor is an e-commerce platform that serves high-volume companies. When using `Pickup: Local stock only` click-and-collect as a delivery me CVE-2024-298898.1GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability i CVE-2024-29898.8A vulnerability, which was classified as critical, has been found in Tenda FH1203 2.0.1.6. Affected by this issue is the function fromNatSta CVE-2024-298908.8DataLens is a business intelligence and data visualization system. A specifically crafted request allowed the creation of a special chart ty CVE-2024-298918.7ZITADEL users can upload their own avatar image and various image types are allowed. Due to a missing check, an attacker could upload HTML a CVE-2024-298924.9ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action cou CVE-2024-298936.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the Arg CVE-2024-298944.7Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 contain a residual cross-site scr CVE-2024-2989510.0Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows an CVE-2024-298967.5Astro-Shield is a library to compute the subresource integrity hashes for your JS scripts and CSS stylesheets. When automated CSP headers ge CVE-2024-298974.9CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users with (delete) or (suppressrevision) o CVE-2024-298986.5CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. An oversight during the writing of the patch for CVE-2024-2989