CVE-2024-41262

gistfile1.txt

 [Suggested description]
 immudb v1.9.3 was discovered to use the HTTP protocol in the
 ShowMetricsRaw and ShowMetricsAsText functions, possibly allowing
 attackers to intercept communications via a man-in-the-middle attack.
 ------------------------------------------

 [VulnerabilityType Other]
 CWE-319

 ------------------------------------------

 [Vendor of Product]
 https://github.com/codenotary/immudb

 ------------------------------------------

 [Affected Product Code Base]
 immudb - <=1.9.3

 ------------------------------------------

 [Affected Component]
 immudb cmd service

 ------------------------------------------

 [Attack Type]
 Remote

 ------------------------------------------

 [Impact Information Disclosure]
 true

 ------------------------------------------

 [Attack Vectors]
 use 'immuadmin stats' command

 ------------------------------------------

 [Reference]
 https://docs.immudb.io/

 ------------------------------------------

 [Discoverer]
 Yuexi Zhang