CVE-2024-36496
Last modified
CVE-2024-36496 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The configuration file is encrypted with a static key derived from a static five-character password which allows an attacker to decrypt this file. The application hashes this five-character password with the outdated and broken MD5 algorithm (no salt) and uses the first five bytes as the key for RC4. The configuration file is then encrypted with these parameters.. EPSS estimates a 0.69% chance of exploitation in the next 30 days.
Description
The configuration file is encrypted with a static key derived from a static five-character password which allows an attacker to decrypt this file. The application hashes this five-character password with the outdated and broken MD5 algorithm (no salt) and uses the first five bytes as the key for RC4. The configuration file is then encrypted with these parameters.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-36496?
How severe is CVE-2024-36496?
How do I fix CVE-2024-36496?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-3649The Contact Form by WPForms – Drag & Drop Form Builder for W…5.3
- CVE-2024-36491FutureNet NXR series, VXR series and WXR series provided by …9.8
- CVE-2024-36492Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <=…6.4
- CVE-2024-36493A stack-based buffer overflow vulnerability exists in the wi…7.2
- CVE-2024-36494Due to missing input sanitization, an attacker can perform c…4.7
- CVE-2024-36495The application Faronics WINSelect (Standard + Enterprise) s…7.7
- CVE-2024-36497The decrypted configuration file contains the password in cl…9.1
- CVE-2024-36498Due to missing input sanitization, an attacker can perform c…4.7
- CVE-2024-36499Vulnerability of unauthorized screenshot capturing in the WM…5.5
- CVE-2024-3650The ElementsKit Elementor addons plugin for WordPress is vul…5.4
- CVE-2024-36500Privilege escalation vulnerability in the AMS module Impact:…5.5
- CVE-2024-36501Memory management vulnerability in the boottime module Impac…5.5
Are you affected by CVE-2024-36496?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST