Is CVE-2024-45391 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-45391 being exploited in the wild.

How severe is CVE-2024-45391?

Low severity, with a CVSS score of 3.1, published 3 September 2024.

Which products and versions are affected?

@tinacms/cli (npm) SEMVER:introduced=0,fixed=1.6.2.

Is there a fix for CVE-2024-45391?

Yes. @tinacms/cli (npm): upgrade to 1.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-45391 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-45391?

Check whether you run @tinacms/cli (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-45391: TinaCMS search token leak via lock file

CVE-2024-45391 · Severity: low · CVSS 3.1 · Published 2024-09-03

TinaCMS is a popular headless CMS that stores content in GitHub repositories. The CLI tool inadvertently wrote sensitive search API tokens to the tina-lock.json lock file, which could be committed to public repositories. An attacker gaining access to this file could use the leaked token to query the search index without authorization, potentially exposing or manipulating indexed content.

Technologies: @tinacms/cli (npm). Vendors: npm.

Quick answers

Is CVE-2024-45391 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-45391 being exploited in the wild.
How severe is CVE-2024-45391?: Low severity, with a CVSS score of 3.1, published 3 September 2024.
Which products and versions are affected?: @tinacms/cli (npm) SEMVER:introduced=0,fixed=1.6.2.
Is there a fix for CVE-2024-45391?: Yes. @tinacms/cli (npm): upgrade to 1.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-45391 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-45391?: Check whether you run @tinacms/cli (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@tinacms/cli (npm): upgrade to 1.6.2 or later
```
npm install @tinacms/cli@1.6.2
```

Technical details

The @tinacms/cli package with versions prior to 1.6.2 incorrectly includes search configuration containing API tokens in the tina-lock.json lock file during the build process. The vulnerability stems from insufficient filtering of sensitive configuration fields before serializing the lock file. The attack vector is network-based with no authentication or user interaction required; an attacker only needs access to the lock file (commonly stored in version control). The vulnerability allows confidentiality breach through token theft and unauthorized search API access. The fix was released in @tinacms/cli@1.6.2, which filters out search configuration from the lock file output. Users must upgrade and rotate their search tokens immediately.

Affected products

TinaCMS @tinacms/cli < 1.6.2

Identifiers

CVE-2024-45391
GHSA-4qrm-9h4r-v2fx

Timeline

2024-09-03: disclosed: Vulnerability published as GHSA-4qrm-9h4r-v2fx and CVE-2024-45391
2024-09-03: patched: Fix released in @tinacms/cli@1.6.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.