Lucene search

VulDBCVE-2024-8417

HistorySep 04, 2024 - 6:15 p.m.

CVE-2024-8417

2024-09-0418:15:06

CWE-540

VulDB

web.nvd.nist.gov

vulnerability

yunke online school system

remote attack

sensitive information

code manipulation

public disclosure

upgrade

security issue

CVSS2

2.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:S/C:P/I:N/A:N

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS4

2.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

3.8

Confidence

High

EPSS

0.001

Percentile

27.7%

JSON

A vulnerability was found in ??? Yunke Online School System up to 1.5.5. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/educloud/videobind.html. The manipulation leads to inclusion of sensitive information in source code. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.6 is able to address this issue. It is recommended to upgrade the affected component.

Affected configurations

Nvd

Vulners

Vulnrichment

Node

yunknetonline_school_systemRange<1.5.6

VendorProductVersionCPE
yunknetonline_school_system*cpe:2.3:a:yunknet:online_school_system:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
yunknet	online_school_system	*	cpe:2.3:a:yunknet:online_school_system::::::::

CNA Affected

[
  {
    "vendor": "云课网络科技有限公司",
    "product": "Yunke Online School System",
    "versions": [
      {
        "version": "1.5.0",
        "status": "affected"
      },
      {
        "version": "1.5.1",
        "status": "affected"
      },
      {
        "version": "1.5.2",
        "status": "affected"
      },
      {
        "version": "1.5.3",
        "status": "affected"
      },
      {
        "version": "1.5.4",
        "status": "affected"
      },
      {
        "version": "1.5.5",
        "status": "affected"
      }
    ]
  }
]

References

vuldb.com/?ctiid.276496

vuldb.com/?id.276496

vuldb.com/?submit.402376

wiki.shikangsi.com/post/share/d31fefa1-ca08-48d7-a671-727d63bfaf65

CVSS2

2.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:S/C:P/I:N/A:N

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS4

2.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

3.8

Confidence

High

EPSS

0.001

Percentile

27.7%

JSON

Related for CVE-2024-8417