What’s Vulnerable › Vulnerabilities

CVE-2024-8005: demozx gf_cms JWT Authentication auth.go init hard-coded credentials

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-08-20 · updated 2026-06-17
• Weakness: CWE-798

Description

A vulnerability was found in demozx gf_cms 1.0/1.0.1. It has been classified as critical. This affects the function init of the file internal/logic/auth/auth.go of the component JWT Authentication. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.2 is able to address this issue. The patch is named be702ada7cb6fdabc02689d90b38139c827458a5. It is recommended to upgrade the affected component.

Affected products

• demozx gf_cms: from 1.0 before 1.0.2 — fixed in 1.0.2

How to fix

Upgrade to a fixed version: demozx gf_cms 1.0.2. Check the vendor advisory for mitigations.

References

• https://github.com/demozx/gf_cms/commit/be702ada7cb6fdabc02689d90b38139c827458a5
• https://github.com/demozx/gf_cms/commit/de51cc57a96ccca905c837ef925c2cc3a5241383
• https://github.com/demozx/gf_cms/issues/5
• https://github.com/demozx/gf_cms/issues/5#issuecomment-2296590417
• https://vuldb.com/?ctiid.275199
• https://vuldb.com/?id.275199
• https://vuldb.com/?submit.393981

Get alerted when CVE-2024-8005 or the next vulnerability affects your stack