4 matches found
CVE-2024-27632
CVE-2024-27632 affects GNU Savane, version 3.12 and earlier. The issue is an elevation of privilege due to the form_id in the form_header() function, enabling a remote attacker to escalate privileges. The vulnerability is documented across multiple sources (NVD/Red Hat/CNVD/CVE records). Impact i...
CVE-2024-27631
CVE-2024-27631 is a CSRF vulnerability in GNU Savane (versions 3.12 and earlier) that allows a remote attacker to escalate privileges via the siteadmin/usergroup.php endpoint. The Red Hat, CNVD, CNNVD, CVE List, and CNVD entries corroborate a CSRF flaw enabling privilege escalation; the issue is ...
CVE-2024-27630
CVE-2024-27630 affects GNU Savane v3.12 and earlier where an Insecure Direct Object Reference (IDOR) exists in the trackers_data_delete_file function, enabling remote deletion of arbitrary files. Exploitation details are not fully enumerated in the provided sources, but risk is described as remot...