CVE-2024-24553: Bludit uses SHA1 as Password Hashing Algorithm
Bludit uses the SHA-1 hashing algorithm to compute password hashes. Thus, attackers could determine cleartext passwords with brute-force attacks due to the inherent speed of SHA-1. In addition, the salt that is computed by Bludit is generated with a non-cryptographically secure function.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-24553?
CVE-2024-24553 is considered a high-severity vulnerability due to the use of SHA-1 hashing for password protection.
How do I fix CVE-2024-24553?
To fix CVE-2024-24553, update Bludit to a version that uses a more secure hashing algorithm, such as bcrypt.
What impact does CVE-2024-24553 have on users?
CVE-2024-24553 allows attackers to potentially recover user passwords through brute-force attacks due to weaknesses in SHA-1 and the non-cryptographically secure salt.
Are older versions of Bludit affected by CVE-2024-24553?
Yes, older versions of Bludit that use the SHA-1 hashing algorithm for passwords are affected by CVE-2024-24553.
Is there a workaround for CVE-2024-24553?
A temporary workaround for CVE-2024-24553 is to implement additional rate limiting on login attempts while awaiting a patch.