How severe is CVE-2024-31995?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 4.3 out of 10.

What type of vulnerability is CVE-2024-31995?

This is classified as CWE-613, which is a common weakness in software security.

CVE-2024-31995 - MEDIUM Severity | CVSS 4.3

Vulnerability Description

`@digitalbazaar/zcap` provides JavaScript reference implementation for Authorization Capabilities. Prior to version 9.0.1, when invoking a capability with a chain depth of 2, i.e., it is delegated directly from the root capability, the `expires` property is not properly checked against the current date or other `date` param. This can allow invocations outside of the original intended time period. A zcap still cannot be invoked without being able to use the associated private key material. `@digitalbazaar/zcap` v9.0.1 fixes expiration checking. As a workaround, one may revoke a zcap at any time.

Related Vulnerabilities

CVE-2020-13305

MEDIUM

CVSS:4.3(Medium)

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not invalidating project invitation link upon removing a user from a project.

CWE-6132020

CVE-2020-1724

MEDIUM

CVSS:4.3(Medium)

A flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to see the personal information of a previously logged out user in the account man...

CWE-6132020

CVE-2020-1776

MEDIUM

CVSS:4.3(Medium)

When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the case the agent is invalid. This issue affect...

CWE-6132020

CVE-2020-4780

MEDIUM

CVSS:4.3(Medium)

OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Management 7.0.9 and 7.0,10. The purpose of the 'secure' attribute is to prevent cookie...

CWE-6132020

CVE-2021-20431

MEDIUM

CVSS:4.3(Medium)

IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 does not invalidate session after logout which could allow an an attacker to obtain sensitive information from the system. IBM X-Force ID: 196...

CWE-6132021

CVE-2021-20581

MEDIUM

CVSS:4.3(Medium)

IBM Security Verify Privilege On-Premises 11.5 could allow a user to obtain sensitive information due to insufficient session expiration. IBM X-Force ID: 199324.

CWE-6132021