CVE-2024-45340

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not have access to. By default, unless otherwise set, this only affected credentials stored in the users .netrc file.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Jan 28, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-453416.1A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificaCVE-2024-453468.8The Xiaomi Security Center expresses heartfelt thanks to Ken Gannon and Ilyes Beghdadi of NCC Group working with Trend Micro Zero Day InitiaCVE-2024-453479.6An unauthorized access vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flaCVE-2024-453488.8Xiaomi Router AX9000 has a post-authorization command injection vulnerability. This vulnerability is caused by the lack of validation of useCVE-2024-45358.8The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF checks in some places, which could allow attackers to make loggCVE-2024-453517.8A code execution vulnerability exists in the Xiaomi Game center application product. The vulnerability is caused by improper input validatiCVE-2024-453528.8An code execution vulnerability exists in the Xiaomi smarthome application product. The vulnerability is caused by improper input validationCVE-2024-453534.3An intent redriction vulnerability exists in the Xiaomi quick App framework application product. The vulnerability is caused by improper inpCVE-2024-453544.3A code execution vulnerability exists in the Xiaomi shop applicationproduct. The vulnerability is caused by improper input validation and caCVE-2024-453555.5A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be explCVE-2024-453567.3A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be explCVE-2024-45365.3In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an