How severe is CVE-2024-11619?

CVE-2024-11619 has a CVSS 3.x base score of 5.0, rated medium severity. It is exploitable over an adjacent network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.

Is CVE-2024-11619 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (49th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-11619?

CVE-2024-11619 affects Macrozheng Mall. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-11619?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-11619 have an EU (EUVD) identifier?

Yes. CVE-2024-11619 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-33919.

When was CVE-2024-11619 published?

CVE-2024-11619 was published on 2024-11-22 and last updated on 2026-06-17.

CVE-2024-11619

CVE-2024-11619 is a medium-severity vulnerability in Macrozheng Mall with a CVSS 3.x base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1394.

Key facts

Severity: Medium (CVSS 3.x base score 5.0)
CVSS v2: 4.3
CVSS v4: 2.3
EPSS exploit prediction: 1% (49th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-33919
Weakness: CWE-1394
Affected product: Macrozheng Mall
Published: 2024-11-22
Last modified: 2026-06-17

Description

A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3. Affected by this issue is some unknown functionality of the component JWT Token Handler. The manipulation leads to use of default cryptographic key. The complexity of an attack is rather high. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way. Instead the issue posted on GitHub got deleted without any explanation.

Frequently asked questions

What is CVE-2024-11619?: A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3. Affected by this issue is some unknown functionality of the component JWT Token Handler. The manipulation leads to use of default cryptographic key. The complexity of an attack is rather high. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way. Instead the issue posted on GitHub got deleted without any explanation.
How severe is CVE-2024-11619?: CVE-2024-11619 has a CVSS 3.x base score of 5.0, rated medium severity. It is exploitable over an adjacent network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.
Is CVE-2024-11619 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (49th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-11619?: CVE-2024-11619 affects Macrozheng Mall. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-11619?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-11619 have an EU (EUVD) identifier?: Yes. CVE-2024-11619 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-33919.
When was CVE-2024-11619 published?: CVE-2024-11619 was published on 2024-11-22 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:macrozheng:mall:*:*:*:*:*:*:*:*

More vulnerabilities in Macrozheng Mall

CVE-2026-25858 — Critical (CVSS 9.1): macrozheng mall version 1.0.3 and prior contains an authentication vulnerability in the mall-portal password reset…
CVE-2025-13118 — Medium (CVSS 6.3): A vulnerability was detected in macrozheng mall-swarm up to 1.0.3. Affected by this issue is the function paySuccess of…
CVE-2025-13443 — Medium (CVSS 5.4): A vulnerability was detected in macrozheng mall up to 1.0.3. Affected by this issue is the function delete of the file…
CVE-2025-13117 — Medium (CVSS 5.4): A security vulnerability has been detected in macrozheng mall-swarm and mall up to 1.0.3. Affected by this…
CVE-2025-13116 — Medium (CVSS 5.4): A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. Affected is the function cancelUserOrder…
CVE-2025-8755 — Medium (CVSS 5.3): A vulnerability was found in macrozheng mall up to 1.0.3 and classified as problematic. This issue affects the function…

All CVEs affecting Macrozheng Mall →

Other CWE-1394 vulnerabilities

CVE-2025-41742 — Critical (CVSS 9.8): Sprecher Automations SPRECON-E-C, SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote…
CVE-2024-48956 — Critical (CVSS 9.8): Serviceware Processes 6.0 through 7.3 before 7.4 allows attackers without valid authentication to send a specially…
CVE-2025-41744 — Critical (CVSS 9.1): Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to…
CVE-2025-55049 — Critical (CVSS 9.1): Use of Default Cryptographic Key (CWE-1394)
CVE-2024-1275 — Critical (CVSS 9.1): Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow…
CVE-2024-29037 — Critical (CVSS 9.1): datahub-helm provides the Kubernetes Helm charts for deploying Datahub and its dependencies on a Kubernetes cluster.…

Browse all CWE-1394 vulnerabilities →