VDB
CVE-2024-41260
CVE-2024-41260
PUBLISHED
CVSS 8.699999809265137 HIGH
A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database.
EPSS 0.47% · 40.7th percentile
Risk Scores
CVSS 4.0
8.699999809265137
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS Score
0.47%
40.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| github.com | netbirdio/netbird | 0.23.2 |
| netbirdio | netbird | 0.28.4 |
| n/a | n/a | n/a |
Timeline
- Aug 1, 2024 CVE Published
- Aug 1, 2024 PoC Published
- Aug 2, 2024 EPSS Score
- Aug 24, 2024 EPSS Score
- Sep 15, 2024 EPSS Score
- Oct 4, 2024 Coalition ESS Score
- Oct 7, 2024 EPSS Score
- Oct 29, 2024 EPSS Score
- Nov 20, 2024 EPSS Score
- Dec 13, 2024 EPSS Score
- Jan 4, 2025 EPSS Score
- Jan 27, 2025 EPSS Score
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-41260 advisory
- https://github.com/netbirdio/netbird package
- https://gist.github.com/nyxfqq/92232108ac153e95d538bb17fc5ad636 exploit
- https://github.com/netbirdio/netbird/pull/2569 fix
- https://github.com/github/advisory-database/pull/5714 fix
- https://github.com/netbirdio/netbird/issues/2246 discussion
- https://github.com/netbirdio/netbird/commit/cf6210a6f42355e88c422c624376f6fcdaea6729 fix
- https://github.com/advisories/GHSA-9v35-4xcr-w9ph advisory