CVE-2024-8644: valeapp (CVSS 7.5)

Description

Cleartext Storage of Sensitive Information in a Cookie vulnerability in Oceanic Software ValeApp allows Protocol Manipulation, : JSON Hijacking (aka JavaScript Hijacking).This issue affects ValeApp: before v2.0.0.

Is your site exposed to CVE-2024-8644?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness Type (CWE)

CWE-315 CWE-315

CWE-312 CWE-312

Affected Products

Vendor	Product	Versions
oceanicsoft	valeapp	< 2.0.0

References

Other References

https://www.usom.gov.tr/bildirim/tr-24-1562

Frequently Asked Questions

What is CVE-2024-8644? +

Cleartext Storage of Sensitive Information in a Cookie vulnerability in Oceanic Software ValeApp allows Protocol Manipulation, : JSON Hijacking (aka JavaScript Hijacking).This issue affects ValeApp: before v2.0.0. It has a CVSS v3.1 base score of 7.5 (HIGH).

How severe is CVE-2024-8644? +

CVE-2024-8644 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-8644? +

CVE-2024-8644 affects products from oceanicsoft, specifically: valeapp. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-8644? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-41290 8.1

FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component.

CVE-2024-24768 6.5

1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel …

CVE-2025-8528 3.7

A vulnerability classified as problematic has been found in Exrick xboot up to 3.3.4. Affected is an unknown function of …

CVE-2025-4537 3.1

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. Affected by this issue is some …

CVE-2024-8607 9.8

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oceanic Software ValeApp allows SQL Injection.This …

CVE-2024-8643 9.8

Session Fixation vulnerability in Oceanic Software ValeApp allows Brute Force, Session Hijacking.This issue affects ValeApp: before v2.0.0.

CVE-2024-8644