Lucene search

VulDBCVE-2024-7437

HistoryAug 03, 2024 - 3:15 p.m.

CVE-2024-7437

2024-08-0315:15:58

CWE-99

CWE-639

VulDB

web.nvd.nist.gov

simplemachines

smf

vulnerability

critical

remote attack

improper control

resource identifiers

public exploit

vdb-273522

disclosure

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CVSS4

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/SC:N/VI:L/SI:N/VA:L/SA:N

EPSS

0.001

Percentile

51.1%

JSON

A vulnerability, which was classified as critical, was found in SimpleMachines SMF 2.1.4. Affected is an unknown function of the file /index.php?action=profile;u=2;area=showalerts;do=remove of the component Delete User Handler. The manipulation of the argument aid leads to improper control of resource identifiers. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Affected configurations

Nvd

Vulners

Vulnrichment

Node

simplemachinessimple_machines_forumMatch2.1.4

VendorProductVersionCPE
simplemachinessimple_machines_forum2.1.4cpe:2.3:a:simplemachines:simple_machines_forum:2.1.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
simplemachines	simple_machines_forum	2.1.4	cpe:2.3:a:simplemachines:simple_machines_forum:2.1.4:::::::*

CNA Affected

[
  {
    "vendor": "SimpleMachines",
    "product": "SMF",
    "versions": [
      {
        "version": "2.1.4",
        "status": "affected"
      }
    ],
    "modules": [
      "Delete User Handler"
    ]
  }
]

References

github.com/Fewword/Poc/blob/main/smf/smf-poc1.md

vuldb.com/?ctiid.273522

vuldb.com/?id.273522

vuldb.com/?submit.380189

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CVSS4

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/SC:N/VI:L/SI:N/VA:L/SA:N

EPSS

0.001

Percentile

51.1%

JSON

Related for CVE-2024-7437