← volver
CVE-2024-34695mediumCWE-799

WOWS Karma vulnerable to a post submission bounce/timing attack

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.3epss 0.8%
probabilidad de explotación
0.8%top 48% de las CVE
explotación observada
noninguna fuente lo reporta
WOWS Karma is a reputation system for Wargaming's World of Warships. A user is able to click multiple times on "create" on a post creation prompt before the modal closes, which triggers sending several post creation API requests at once. Due to timing, sending multiple posts simultaneously requests bypasses the cooldown validation, however are not refreshing a user's metrics more than once, due to concurrent karma updates. This issue is fixed in 0.17.4.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H
Productos afectados
SakuraIsayeki · WOWS-Karma