CVE-2024-24757 HIGH

CVE-2024-24757: open-irs .env Exposure

Vendor Degamisu

Product open-irs

Weakness CWE-200 · Info exposure

Published February 2, 2024

Last update August 1, 2024

View on NVD All CVEs

CVSS base score

7.6/10

Attack vector Adjacent

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

What the vulnerability does

01Description

open-irs is an issue response robot that reponds to issues in the installed repository. The `.env` file was accidentally uploaded when working with git actions. This problem is fixed in 1.0.1. Discontinuing all sensitive keys and turning into secrets.

Key dates

02Disclosure timeline

February 2, 2024 CVE published

August 1, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-24757 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/200.html

Related vulnerabilities

04Related CVE

CVE-2026-54673 electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime` CVE-2026-42907 Windows Shell Information Disclosure Vulnerability CVE-2026-44785 Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts CVE-2026-42971 Windows Push Notification Information Disclosure Vulnerability CVE-2026-44486 Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection