Lucene search

INCIBECVELIST:CVE-2024-1145

HistoryMar 19, 2024 - 11:35 a.m.

CVE-2024-1145 Observable Response Discrepancy at Alma Devklan Blog

2024-03-1911:35:46

CWE-204

INCIBE

www.cve.org

cve-2024-1145

observable response discrepancy

user enumeration

remote user

valid users

application

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

User enumeration vulnerability in Devklan’s Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow a remote user to retrieve all valid users registered in the application just by looking at the request response.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Alma Blog",
    "vendor": "Devklan",
    "versions": [
      {
        "lessThanOrEqual": "2.1.10",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alma-devklan-blog

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

Related for CVELIST:CVE-2024-1145