Lucene search

VulDBCVELIST:CVE-2024-8417

HistorySep 04, 2024 - 5:31 p.m.

CVE-2024-8417 云课网络科技有限公司 Yunke Online School System videobind.html sensitive information in source

2024-09-0417:31:08

CWE-540

VulDB

www.cve.org

vulnerability

yunke online school system

videobind.html

sensitive information

remote attack

version 1.5.5

upgrade

CVSS2

2.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:S/C:P/I:N/A:N

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS4

2.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N

EPSS

0.001

Percentile

27.7%

JSON

A vulnerability was found in 云课网络科技有限公司 Yunke Online School System up to 1.5.5. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/educloud/videobind.html. The manipulation leads to inclusion of sensitive information in source code. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.6 is able to address this issue. It is recommended to upgrade the affected component.

CNA Affected

[
  {
    "vendor": "云课网络科技有限公司",
    "product": "Yunke Online School System",
    "versions": [
      {
        "version": "1.5.0",
        "status": "affected"
      },
      {
        "version": "1.5.1",
        "status": "affected"
      },
      {
        "version": "1.5.2",
        "status": "affected"
      },
      {
        "version": "1.5.3",
        "status": "affected"
      },
      {
        "version": "1.5.4",
        "status": "affected"
      },
      {
        "version": "1.5.5",
        "status": "affected"
      }
    ]
  }
]

References

vuldb.com/?ctiid.276496

vuldb.com/?id.276496

vuldb.com/?submit.402376

wiki.shikangsi.com/post/share/d31fefa1-ca08-48d7-a671-727d63bfaf65

CVSS2

2.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:S/C:P/I:N/A:N

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS4

2.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N

EPSS

0.001

Percentile

27.7%

JSON

Related for CVELIST:CVE-2024-8417