CVE-2024-45340 – Cisco GOAUTH Domain Misaligned Credentialsfuscation
The following table lists the changes that have been made to the CVE-2024-45340 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability’s severity, exploitability, or other characteristics.
-
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jan. 28, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by [email protected]
Jan. 28, 2025
Action Type Old Value New Value Added Description Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not have access to. By default, unless otherwise set, this only affected credentials stored in the users .netrc file. Added Reference https://go.dev/cl/643097 Added Reference https://go.dev/issue/71249 Added Reference https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ Added Reference https://pkg.go.dev/vuln/GO-2025-3383