CVEvulnerability

CVE-2024-41260

7.5 HIGH Published 2024-08-01 Modified 2026-06-17 Official page ↗

Status: Deferred
Published: 2024-08-01
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-321

Description

A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database.

Weakness · CWE (1)

CWE-321 Use of Hard-coded Cryptographic Key weakness

References

https://gist.github.com/nyxfqq/92232108ac153e95d538bb17fc5ad636 gist.github.com
https://github.com/github/advisory-database/pull/5714 github.com
https://github.com/netbirdio/netbird/pull/2569 github.com

CVE-2024-41260

Description

Related

Weakness · CWE (1)

References