// For flags

CVE-2024-34360

Previous ATX is not checked to be the newest valid ATX by Smesher when validating incoming ATX

Severity Score

8.2
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

go-spacemesh is a Go implementation of the Spacemesh protocol full node. Nodes can publish activations transactions (ATXs) which reference the incorrect previous ATX of the Smesher that created the ATX. ATXs are expected to form a single chain from the newest to the first ATX ever published by an identity. Allowing Smeshers to reference an earlier (but not the latest) ATX as previous breaks this protocol rule and can serve as an attack vector where Nodes are rewarded for holding their PoST data for less than one epoch but still being eligible for rewards. This vulnerability is fixed in go-spacemesh 1.5.2-hotfix1 and Spacemesh API 1.37.1.

go-spacemesh es una implementación Go del nodo completo del protocolo Spacemesh. Los nodos pueden publicar transacciones de activaciones (ATX) que hacen referencia al ATX anterior incorrecto del Smesher que creó el ATX. Se espera que los ATX formen una única cadena desde el más nuevo hasta el primer ATX jamás publicado por una identidad. Permitir que Smeshers haga referencia a un ATX anterior (pero no al último) como anterior rompe esta regla de protocolo y puede servir como un vector de ataque donde los nodos son recompensados por conservar sus datos PoST durante menos de una época pero aún ser elegibles para recibir recompensas. Esta vulnerabilidad se solucionó en go-spacemesh 1.5.2-hotfix1 y Spacemesh API 1.37.1.

It was discovered that Cacti did not properly apply checks to the "Package Import" feature. An attacker could possibly use this issue to perform arbitrary code execution. This issue only affected Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04 LTS. It was discovered that Cacti did not properly sanitize values when using javascript based API. A remote attacker could possibly use this issue to inject arbitrary javascript code resulting into cross-site scripting vulnerability. This issue only affected Ubuntu 24.04 LTS.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-05-02 CVE Reserved
  • 2024-05-10 CVE Published
  • 2024-05-11 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-754: Improper Check for Unusual or Exceptional Conditions
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Spacemeshos
Search vendor "Spacemeshos"
 Go-spacemesh
Search vendor "Spacemeshos" for product "Go-spacemesh"
 < 1.5.2
Search vendor "Spacemeshos" for product "Go-spacemesh" and version " < 1.5.2"
en
Affected