Lucene search

KasperskyCVE-2024-8651

HistorySep 19, 2024 - 5:15 p.m.

CVE-2024-8651

2024-09-1917:15:15

CWE-203

CWE-204

Kaspersky

web.nvd.nist.gov

vulnerability

netcat cms

http request

user existence

system security

patch

vendor

netcat.ru

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS4

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

A vulnerability in NetCat CMS allows an attacker to send a specially crafted http request that can be used to check whether a user exists in the system, which could be a basis for further attacks.
This issue affects NetCat CMS v. 6.4.0.24126.2 and possibly others.

Apply patch from vendor https://netcat.ru/ https://netcat.ru/] . Versions 6.4.0.24248 and on have the patch.

Affected configurations

Nvd

Node

netcatnetcat_content_management_systemRange<6.4.0.24248-

VendorProductVersionCPE
netcatnetcat_content_management_system*cpe:2.3:a:netcat:netcat_content_management_system:*:*:*:*:-:*:*:*

Vendor	Product	Version	CPE
netcat	netcat_content_management_system	*	cpe:2.3:a:netcat:netcat_content_management_system:::::-:::*

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "NetCat CMS",
    "vendor": "NetCat",
    "versions": [
      {
        "status": "affected",
        "version": "6.4.0.24126.2"
      },
      {
        "status": "unaffected",
        "version": "6.4.0.24248"
      }
    ]
  }
]

References

github.com/klsecservices/Advisories/blob/master/K-NetCat-2024-001.md

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS4

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

Related for CVE-2024-8651