CVE-2024-34695
WOWS Karma vulnerable to a post submission bounce/timing attack
- State
- Published
- Severity
- 6.3 Medium
- Published
- May 10, 2024
- Updated
- Aug 2, 2024
- Reserved
- May 7, 2024
Description
WOWS Karma is a reputation system for Wargaming's World of Warships. A user is able to click multiple times on "create" on a post creation prompt before the modal closes, which triggers sending several post creation API requests at once. Due to timing, sending multiple posts simultaneously requests bypasses the cooldown validation, however are not refreshing a user's metrics more than once, due to concurrent karma updates. This issue is fixed in 0.17.4.1.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H | GitHub_M |
Weaknesses
- CWE-799 Improper Control of Interaction Frequency
Affected Products
| Product | Versions |
|---|---|
WOWS-KarmaSakuraIsayeki |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.