CVE-2024-5732
Clash Proxy Port improper authentication
- State
- Published
- Severity
- 6.9 Medium
- Published
- Jun 7, 2024
- Updated
- Aug 1, 2024
- Reserved
- Jun 7, 2024
Description
A vulnerability was found in Clash up to 0.20.1 on Windows. It has been declared as critical. This vulnerability affects unknown code of the component Proxy Port. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-267406 is the identifier assigned to this vulnerability.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P | VulDB |
Weaknesses
- CWE-287 Improper Authentication
Affected Products
| Product | Versions |
|---|---|
Clashn/a |
|
References
- VDB-267406 | Clash Proxy Port improper authenticationvdb-entry
- VDB-267406 | CTI Indicators (IOB, IOC)signaturepermissions-required
- Submit #345469 | clash for windows 0.10-0.0.20.1 Unverified Ownershipthird-party-advisory
- https://github.com/GTA12138/vul/blob/main/clash%20for%20windows.mdexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.