{"action":"Upgrade Duende.IdentityServer to 7.0.8 or later.","affected":[{"fixed":"7.0.8","introduced":"7.0.0"}],"component":"Duende.IdentityServer","cve_ids":["CVE-2024-49755"],"ecosystem":"NuGet","epss":0.00348,"exploited":false,"fixed_versions":["7.0.8"],"ghsa_id":"GHSA-v9xq-2mvm-x8xc","id":"tcs_01M5N91ETSACJVFNR1313EB8H7","modified_at":"2024-10-28T22:00:54.470727Z","published_at":"2024-10-28T19:44:10Z","references":["https://osv.dev/vulnerability/GHSA-v9xq-2mvm-x8xc","https://github.com/DuendeSoftware/IdentityServer/security/advisories/GHSA-v9xq-2mvm-x8xc","https://nvd.nist.gov/vuln/detail/CVE-2024-49755","https://github.com/DuendeSoftware/IdentityServer/commit/f28cac921c1f545afe65af71a9327224755b6dac","https://github.com/DuendeSoftware/IdentityServer"],"severity":{"label":"low","score":3.1},"sources":[{"source":"osv","source_id":"GHSA-v9xq-2mvm-x8xc","url":"https://osv.dev/vulnerability/GHSA-v9xq-2mvm-x8xc"}],"summary":"Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs"}