Lucene search

GoogleOSV:CVE-2024-23756

HistoryFeb 08, 2024 - 9:15 p.m.

CVE-2024-23756

2024-02-0821:15:08

Google

osv.dev

cve-2024-23756

http methods

put

delete

plone

docker

unauthenticated

attackers

uploading files

deleting files

software

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.3 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.8%

JSON

The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangerous actions such as uploading files to the server or deleting them.

CPENameOperatorVersion
ploneeq5.0a3
ploneeq5.0rc2
ploneeq5.2.5
ploneeq4.1a2
ploneeq4.2a1
ploneeq5.2rc3
ploneeq5.1.0
ploneeq4.1b2
ploneeq5.1.1
ploneeq5.1b3

Name	Operator	Version
plone	eq	5.0a3
plone	eq	5.0rc2
plone	eq	5.2.5
plone	eq	4.1a2
plone	eq	4.2a1
plone	eq	5.2rc3
plone	eq	5.1.0
plone	eq	4.1b2
plone	eq	5.1.1
plone	eq	5.1b3

Rows per page:

1-10 of 661

References

github.com/c0d3x27/CVEs/tree/main/CVE-2024-23756

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.3 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.8%

JSON

Related for OSV:CVE-2024-23756