CVE-2024-42370

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue grants a malicious actor the permission to write issues, read metadata, and write pull requests. In addition, the `DOCS_PREVIEW_DEPLOY_TOKEN` is exposed to the attacker. Commit 84d351e96aaa2a1338006d6e7221eded161f517b contains a fix for this issue.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Aug 12, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-423715.4The RFC enabled function module allows a low privileged user to delete the workplace favourites of any user. This vulnerability could be uti CVE-2024-423726.5Due to missing authorization check in SAP NetWeaver AS Java (System Landscape Directory) an unauthorized user can read and modify some restr CVE-2024-423735.4SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential esca CVE-2024-423748.2BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can re CVE-2024-423754.3SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that coul CVE-2024-423766.5SAP Shared Service Framework does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges CVE-2024-423774.3SAP shared service framework allows an authenticated non-administrative user to call a remote-enabled function, which will allow them to ins CVE-2024-423786.1Due to weak encoding of user-controlled inputs, eProcurement on SAP S/4HANA allows malicious scripts to be executed in the application, pote CVE-2024-42388.8A vulnerability has been found in Tenda AX1806 1.0.0.1 and classified as critical. Affected by this vulnerability is the function formSetDev CVE-2024-423804.3The RFC enabled function module allows a low privileged user to read any user's workplace favourites and user menu along with all the specif CVE-2024-423818.3os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve CVE-2024-423839.8Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows to write a NULL byte value beyond the memory sp