Homepage
About Snyk

Improper Certificate Validation Affecting LizardByte/Sunshine package, versions [,2024.910.1354)

Severity

 Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    EPSS
    0.06% (30th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-UNMANAGED-LIZARDBYTESUNSHINE-7930912
  • published 11 Sep 2024
  • disclosed 10 Sep 2024
  • credit Yukino Song
Report a new vulnerability Found a mistake?

Introduced: 10 Sep 2024

CVE-2024-45407 Open this link in a new tab
CWE-295 Open this link in a new tab

How to fix?

Upgrade LizardByte/Sunshine to version 2024.910.1354 or higher.

Overview

Affected versions of this package are vulnerable to Improper Certificate Validation during the pairing process. An attacker can gain unauthorized access by exploiting the incorrect persistence of a certificate from a forged pairing attempt, even when the pairing fails due to an incorrect PIN.

CVSS Scores

version 4.0
version 3.1
Expand this section

Snyk

Recommended
6.9 medium
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Attack Requirements (AT)
    None
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    Active
  • Confidentiality (VC)
    High
  • Integrity (VI)
    None
  • Availability (VA)
    None
  • Confidentiality (SC)
    None
  • Integrity (SI)
    None
  • Availability (SA)
    None