CVE-2024-12039

langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess attempts for password reset. This allows an unauthenticated attacker to reset owner, admin, or other user passwords within a few hours by guessing the six-digit code, resulting in a complete compromise of the application.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://huntr.com/bounties/61af30d5-6055-4c6c-8a55-3fa43dada512	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:langgenius:dify:0.10.1:*:*:*:*:node.js:*:*

History

15 Jul 2025, 15:59

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~7.4~~	v2 : unknown v3 : 8.1
First Time		Langgenius dify Langgenius
Summary		(es) La versión v0.10.1 de langgenius/dify contiene una vulnerabilidad que no limita el número de intentos de adivinación del código para restablecer la contraseña. Esto permite a un atacante no autenticado restablecer las contraseñas de propietario, administrador u otros usuarios en pocas horas adivinando el código de seis dígitos, lo que compromete completamente la aplicación.
CPE		cpe:2.3:a:langgenius:dify:0.10.1:::::node.js::
References	~~() https://huntr.com/bounties/61af30d5-6055-4c6c-8a55-3fa43dada512 -~~	() https://huntr.com/bounties/61af30d5-6055-4c6c-8a55-3fa43dada512 - Exploit, Third Party Advisory

20 Mar 2025, 10:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-03-20 10:15

Updated : 2025-07-15 15:59

NVD link : CVE-2024-12039

Mitre link : CVE-2024-12039

CVE.ORG link : CVE-2024-12039

JSON object : View

Products Affected

langgenius

dify

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2024-12039", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2025-03-20T10:15:26.270", "references": [{"url": "https://huntr.com/bounties/61af30d5-6055-4c6c-8a55-3fa43dada512", "tags": ["Exploit", "Third Party Advisory"], "source": "security@huntr.dev"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess attempts for password reset. This allows an unauthenticated attacker to reset owner, admin, or other user passwords within a few hours by guessing the six-digit code, resulting in a complete compromise of the application."}, {"lang": "es", "value": "La versi\u00f3n v0.10.1 de langgenius/dify contiene una vulnerabilidad que no limita el n\u00famero de intentos de adivinaci\u00f3n del c\u00f3digo para restablecer la contrase\u00f1a. Esto permite a un atacante no autenticado restablecer las contrase\u00f1as de propietario, administrador u otros usuarios en pocas horas adivinando el c\u00f3digo de seis d\u00edgitos, lo que compromete completamente la aplicaci\u00f3n."}], "lastModified": "2025-07-15T15:59:02.880", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:langgenius:dify:0.10.1:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "BBCA5D7F-39A8-4B8F-9DFF-383365E0AFCD"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}