CVE-2024-48915

HighCVSS 8.7/10Last modified Jun 17, 2026

Description

Agent Dart is an agent library built for Internet Computer for Dart and Flutter apps. Prior to version 1.0.0-dev.29, certificate verification in `lib/agent/certificate.dart` does not occur properly. During the delegation verification in the `_checkDelegation` function, the canister_ranges aren't verified. The impact of not checking the canister_ranges is that a subnet can sign canister responses in behalf of another subnet. The certificate’s timestamp, i.e /time path, is also not verified, meaning that the certificate effectively has no expiration time. Version 1.0.0-dev.29 implements appropriate certificate verification.

Metrics

CVSS 4.0 8.7/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published
Oct 15, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-489168.1Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" CVE-2024-489177.5PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The `XmlScanner` class has a scan method which should prevent XXECVE-2024-489188.1RDS Light is a simplified version of the Reflective Dialogue System (RDS), a self-reflecting AI framework. Versions prior to 1.1.0 contain aCVE-2024-489199.2Cursor is a code editor built for programming with AI. Prior to Sep 27, 2024, if a user generated a terminal command via Cursor's Terminal CCVE-2024-48925.4The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ parameter in versions up to, and incCVE-2024-489209.1PutongOJ is online judging software. Prior to version 2.1.0-beta.1, unprivileged users can escalate privileges by constructing requests. ThiCVE-2024-489212.7Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the CVE-2024-489248.7### Impact When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attacCVE-2024-489256.5Umbraco, a free and open source .NET content management system, has an improper access control issue starting in version 14.0.0 and prior toCVE-2024-489263.1Umbraco, a free and open source .NET content management system, has an insufficient session expiration issue in versions on the 13.x branch CVE-2024-489274.6Umbraco, a free and open source .NET content management system, has a remote code execution issue in versions on the 13.x branch prior to 13CVE-2024-489287.5Piwigo is an open source photo gallery application for the web. In versions on the 14.x branch, when installing, the secret_key configuratio