CVE-2024-37769 - Vulnerability Details - OpenCVE

ReportizFlow

Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact total

Vendors	Products
B1ackc4t	14finger

Configuration 1 [-]

cpe:2.3:a:b1ackc4t:14finger:1.1:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/b1ackc4t/14Finger/issues/12

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-07-05T00:00:00

Updated: 2024-08-02T03:57:39.806Z

Reserved: 2024-06-10T00:00:00

Link: CVE-2024-37769

Vulnrichment

Updated: 2024-07-22T16:49:28.530Z

NVD

Status : Modified

Published: 2024-07-05T16:15:05.110

Modified: 2024-11-21T09:24:18.103

Link: CVE-2024-37769

Redhat

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-37769", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-02T03:57:39.806Z", "dateReserved": "2024-06-10T00:00:00", "datePublished": "2024-07-05T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-07-05T16:04:44.039450"}, "descriptions": [{"lang": "en", "value": "Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/b1ackc4t/14Finger/issues/12"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-278", "lang": "en", "description": "CWE-278 Insecure Preserved Inherited Permissions"}]}], "affected": [{"vendor": "b1ackc4t", "product": "14finger", "cpes": ["cpe:2.3:a:b1ackc4t:14finger:1.1:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1.1", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-07-22T18:16:42.894392Z", "id": "CVE-2024-37769", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-22T18:18:29.603Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:57:39.806Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/b1ackc4t/14Finger/issues/12", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:b1ackc4t:14finger:1.1:*:*:*:*:*:*:*", "matchCriteriaId": "8D0698AC-7300-42D4-B0A2-068DBD590547", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request."}, {"lang": "es", "value": " Los permisos inseguros en 14Finger v1.1 permiten a los atacantes escalar privilegios de usuario normal a administrador mediante una solicitud POST manipulada."}], "id": "CVE-2024-37769", "lastModified": "2024-11-21T09:24:18.103", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-07-05T16:15:05.110", "references": [{"source": "[email protected]", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/b1ackc4t/14Finger/issues/12"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/b1ackc4t/14Finger/issues/12"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "[email protected]", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-278"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}