Security readout for executives and security teams
Plain-English summary
CVE-2024-51037 affects kodbox v1.52.04 and earlier. A remote unauthenticated attacker may obtain sensitive information through the captcha feature in the password reset flow. The disclosed impact is limited to confidentiality, but any issue around account recovery deserves timely review because the affected function is commonly internet-facing.
Executive priority
Handle this as a moderate-priority exposure review. It is not described as data-destructive or actively exploited, but it affects an account recovery path and may disclose sensitive information without authentication.
Technical view
The record describes an information disclosure in kodbox password reset captcha handling, mapped to CWE-346. CVSS 3.1 is 5.3, network exploitable, low complexity, no privileges, no user interaction, unchanged scope, and low confidentiality impact. The bundle does not identify CPEs, a fixed version, or vendor mitigation details.
Likely exposure
Organizations running kodbox v1.52.04 or earlier are the known exposure group. Risk is higher when the password reset workflow is reachable from the internet. The source metadata lists affected vendor and product as n/a, so asset teams should verify product identity through deployment records.
Exploitation context
The CVE is not listed as KEV in the provided bundle. A public disclosure URL is referenced, but the bundle does not prove active exploitation, weaponized tooling, or exploitation at scale. Treat it as publicly known but not confirmed exploited from the supplied evidence.
Researcher notes
Evidence is sparse. The CVE description identifies the vulnerable feature and version ceiling, while affected CPE metadata is absent. Avoid assuming the exact leaked data, exploit reliability, or fixed version unless confirmed by the linked disclosure or kodbox project guidance.
Mitigation direction
- Inventory kodbox deployments and identify versions v1.52.04 or earlier.
- Check the kodbox project and vendor guidance for fixed releases or official mitigations.
- Prioritize externally exposed password reset endpoints for review.
- Limit password reset exposure only where supported and operationally acceptable.
- Monitor account recovery activity for unusual captcha or reset patterns.
Validation and detection
- Confirm whether kodbox is deployed in production, staging, or internet-facing environments.
- Verify installed kodbox versions against the v1.52.04-and-earlier affected range.
- Review password reset and captcha logs for abnormal unauthenticated access patterns.
- Track CVE and project references for updated remediation details.
- Document any compensating controls applied to account recovery endpoints.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-346: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2024-51037 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N3.91.4CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/kalcaddle/kodboxCVE reference, mitre
- https://www.tommonkey.cn/2024/11/13/CVE-2024-51037-Disclosed/CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.