CVE-2024-35539
Last modified
CVE-2024-35539 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Typecho v1.3.0 was discovered to contain a race condition vulnerability in the post commenting function. This vulnerability allows attackers to post several comments before the spam protection checks if the comments are posted too frequently.. EPSS estimates a 1.44% chance of exploitation in the next 30 days.
Description
Typecho v1.3.0 was discovered to contain a race condition vulnerability in the post commenting function. This vulnerability allows attackers to post several comments before the spam protection checks if the comments are posted too frequently.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Typecho | Typecho | 1.3.0 |
References
- https://cyberaz0r.info/2024/08/typecho-multiple-vulnerabilities/Exploit, Third Party Advisory
- https://typecho.orgProduct
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-35539?
How severe is CVE-2024-35539?
How do I fix CVE-2024-35539?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-35526An issue in Daemon PTY Limited FarCry Core framework before …5.9
- CVE-2024-35527An arbitrary file upload vulnerability in /fileupload/upload…9.8
- CVE-2024-3553The Tutor LMS – eLearning and online course solution plugin …6.5
- CVE-2024-35532An XML External Entity (XXE) injection vulnerability in Inte…9.1
- CVE-2024-35537TVS Motor Company Limited TVS Connect Android v4.6.0 and IOS…7.5
- CVE-2024-35538Typecho v1.3.0 was discovered to contain a Client IP Spoofin…5.3
- CVE-2024-3554The All in One SEO – Best WordPress SEO Plugin – Easily Impr…5.4
- CVE-2024-35540A stored cross-site scripting (XSS) vulnerability in Typecho…9
- CVE-2024-35545MAP-OS v4.45.0 and earlier was discovered to contain a cross…6.1
- CVE-2024-35548A SQL injection vulnerability in Mybatis plus versions below…5.4
- CVE-2024-3555The Social Link Pages: link-in-bio landing pages for your so…7.2
- CVE-2024-35550idccms v1.35 was discovered to contain a Cross-Site Request …6.3
Are you affected by CVE-2024-35539?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST