Cyber Resilience

CVE-2024-41290

High

Published: 02 October 2024

Published
02 October 2024
Modified
23 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0188 83.5th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-41290 is a high-severity Cleartext Storage of Sensitive Information in a Cookie (CWE-315) vulnerability in Flatpress Flatpress. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Steal Web Session Cookie (T1539); ranked in the top 16.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component.

CWE(s)
CWE-315

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
attack.mitre.org →
T1555.003 Credentials from Web Browsers Credential Access
Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
attack.mitre.org →
Why these techniques?

Insecure storage of usernames and hashed passwords in client-side cookies enables adversaries to steal web session/authentication cookies (T1539) or extract credentials directly from web browsers (T1555.003) for impersonation or offline cracking.

Affected Assets

flatpress
flatpress
1.3.1

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References