CVE-2024-29886 MEDIUM

CVE-2024-29886: Improved security for stored password hashes

Vendor Serverpod
Product serverpod
Weakness CWE-916
Published March 27, 2024
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Serverpod is an app and web server, built for the Flutter and Dart ecosystem. An issue was identified with the old password hash algorithm that made it susceptible to rainbow attacks if the database was compromised. This vulnerability is fixed by 1.2.6.

Key dates

02Disclosure timeline

March 27, 2024 CVE published
August 2, 2024 Record updated