CVE-2024-38453

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Avalara for Salesforce CPQ app before 7.0 for Salesforce allows attackers to read an API key. NOTE: the current version is 11 as of mid-2024.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522CWE-922

Affected software

No affected versions have been published.

Timeline

Published
Jul 3, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-384546.1ExpressionEngine before 7.4.11 allows XSS.CVE-2024-384567.8HIGH-LEIT V05.08.01.03 and HIGH-LEIT V04.25.00.00 to 4.25.01.01 for Windows from Vivavis contain an insecure file and folder permissions vulCVE-2024-384578.8Xenforo before 2.2.16 allows CSRF.CVE-2024-384588.8Xenforo before 2.2.16 allows code injection.CVE-2024-384597.8langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; thCVE-2024-38464.3Inappropriate implementation in Prompts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in CVE-2024-384606.5In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartexCVE-2024-384617.5irodsServerMonPerf in iRODS before 4.3.2 attempts to proceed with use of a path even if it is not a directory.CVE-2024-384629.8iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the mailMS.cpp#L94-L106 refCVE-2024-384655.3Shenzhen Guoxin Synthesis image system before 8.3.0 allows username enumeration because of the response discrepancy of incorrect versus erroCVE-2024-384669.8Shenzhen Guoxin Synthesis image system before 8.3.0 has a 123456Qw default password.CVE-2024-384677.5Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized user information retrieval via the queryUser API.
CVE-2024-38453: High severity, CVSS 7.5 | Vulnix