VDB
CVE-2024-41260
CVE-2024-41260
PUBLISHED
CVSS 8.699999809265137 HIGH
A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database.
EPSS 0.47% · 39.2th percentile
Risk Scores
CVSS 4.0
8.699999809265137
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS Score
0.47%
39.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| github.com | netbirdio/netbird | 0.23.2, 0.23.2 |
| netbirdio | netbird | 0.28.4, 0.28.4 |
| n/a | n/a | n/a, n/a |
Timeline
- Aug 1, 2024 CVE Published
- Aug 1, 2024 PoC Published
- Aug 2, 2024 EPSS Score
- Aug 23, 2024 EPSS Score
- Sep 14, 2024 EPSS Score
- Oct 4, 2024 Coalition ESS Score
- Oct 5, 2024 EPSS Score
- Oct 27, 2024 EPSS Score
- Nov 17, 2024 EPSS Score
- Dec 10, 2024 EPSS Score
- Dec 31, 2024 EPSS Score
- Jan 22, 2025 EPSS Score
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-41260 advisory
- https://github.com/netbirdio/netbird package
- https://gist.github.com/nyxfqq/92232108ac153e95d538bb17fc5ad636 exploit
- https://github.com/netbirdio/netbird/pull/2569 fix
- https://github.com/github/advisory-database/pull/5714 fix
- https://github.com/netbirdio/netbird/issues/2246 discussion
- https://github.com/netbirdio/netbird/commit/cf6210a6f42355e88c422c624376f6fcdaea6729 fix
- https://github.com/advisories/GHSA-9v35-4xcr-w9ph advisory