CVE-2024-27093

4.6 · MEDIUM

Published Feb 26, 2024 lfprojects CWE-20 EPSS 0.55% (44th pctl) CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Overview

CVE-2024-27093 is a medium-severity vulnerability affecting lfprojects minder. It was published on February 26, 2024 and has a CVSS 3.1 base score of 4.6 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 4.6, rated MEDIUM. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

Technical Description

Minder is a Software Supply Chain Security Platform. In version 0.0.31 and earlier, it is possible for an attacker to register a repository with a invalid or differing upstream ID, which causes Minder to report the repository as registered, but not remediate any future changes which conflict with policy (because the webhooks for the repo do not match any known repository in the database). When attempting to register a repo with a different repo ID, the registered provider must have admin on the named repo, or a 404 error will result. Similarly, if the stored provider token does not have repo access, then the remediations will not apply successfully. Lastly, it appears that reconciliation actions do not execute against repos with this type of mismatch. This appears to primarily be a potential denial-of-service vulnerability. This vulnerability is patched in version 0.20240226.1425+ref.53868a8.

Remediation

Check the references section for vendor advisories and patches from lfprojects. Update minder to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
lfprojects	minder	0	Affected

References

GitHub github.com/stacklok/minder/commit/53868a878e93f29c43437f96dbc990b548e48d1d GitHub github.com/stacklok/minder/security/advisories/GHSA-q6h8-4j2v-pjg4 GitHub github.com/stacklok/minder/commit/53868a878e93f29c43437f96dbc990b548e48d1d GitHub github.com/stacklok/minder/security/advisories/GHSA-q6h8-4j2v-pjg4

Frequently Asked Questions

What is CVE-2024-27093?

CVE-2024-27093 is a medium-severity vulnerability affecting lfprojects minder. It was published on February 26, 2024 and has a CVSS 3.1 base score of 4.6 (MEDIUM).

How severe is CVE-2024-27093?

This vulnerability has a CVSS 3.1 base score of 4.6, rated MEDIUM. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-27093?

How can CyberStrike help with CVE-2024-27093?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-27093 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719