Lucene search

VulDBVULNRICHMENT:CVE-2024-8417

HistorySep 04, 2024 - 5:31 p.m.

CVE-2024-8417 云课网络科技有限公司 Yunke Online School System videobind.html sensitive information in source

2024-09-0417:31:08

CWE-540

VulDB

github.com

cve-2024-8417

yunke online school system

sensitive information

remote attack

code manipulation

source code

upgrade

exploitation

difficulty

CVSS2

2.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:S/C:P/I:N/A:N

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS4

2.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

27.7%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

A vulnerability was found in 云课网络科技有限公司 Yunke Online School System up to 1.5.5. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/educloud/videobind.html. The manipulation leads to inclusion of sensitive information in source code. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.6 is able to address this issue. It is recommended to upgrade the affected component.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:yunknet:yunke_online_school_system:*:*:*:*:*:*:*:*"
    ],
    "vendor": "yunknet",
    "product": "yunke_online_school_system",
    "versions": [
      {
        "status": "affected",
        "version": "1.5.0",
        "versionType": "custom",
        "lessThanOrEqual": "1.5.5"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

vuldb.com/?ctiid.276496

vuldb.com/?id.276496

vuldb.com/?submit.402376

wiki.shikangsi.com/post/share/d31fefa1-ca08-48d7-a671-727d63bfaf65

CVSS2

2.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:S/C:P/I:N/A:N

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

CVSS4

2.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

27.7%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-8417