5.3

CVE-2024-35223: dapr

CVSS: 5.3v3.1MediumDeferred
AliasesGHSA-284c-x8m7-9w5hGO-2024-2879
Published 23-05-2024Last modified 02-08-2024
Open JSON

Vulnerability summary

CVE-2024-35223 is a medium (CVSS 5.3) vulnerability in dapr. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.7% of scored vulnerabilities.

Overall risk
21/100
0100
Low · default modelHow is this calculated?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.44%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 23-05-2024
    PublishedVulnerability first disclosed.
  2. 02-08-2024
    Last modifiedVulnerability information updated.

Description

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invoker app instead of the app token of the invoked app. This causes of a leak of the application token of the invoker app to the invoked app when using Dapr as a gRPC proxy for remote service invocation. This vulnerability impacts Dapr users who use Dapr as a gRPC proxy for remote service invocation as well as the Dapr App API token functionality. An attacker could exploit this vulnerability to gain access to the app token of the invoker app, potentially compromising security and authentication mechanisms. This vulnerability was patched in version 1.13.3.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.44%

Chance of exploitation in the next 30 days

Percentile

37%

Versus all other CVEs

30-day change

0.00 pp

From 0.44% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.44%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Dapr1 product
  • dapr≥ 1.13.0, < 1.13.3
Github.com/dapr1 product
  • dapr≥ 1.13.0, < 1.13.3

2 vendors · 2 products

References

7 links