Lucene search

INCIBECVE-2024-1145

HistoryMar 19, 2024 - 12:15 p.m.

CVE-2024-1145

2024-03-1912:15:08

CWE-204

INCIBE

web.nvd.nist.gov

cve-2024-1145

devklan

alma blog

user enumeration

remote user

information security

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

Percentile

9.0%

JSON

User enumeration vulnerability in Devklan’s Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow a remote user to retrieve all valid users registered in the application just by looking at the request response.

Affected configurations

Vulners

Vulnrichment

Node

devklanalma_blogRange≤2.1.10

VendorProductVersionCPE
devklanalma_blog*cpe:2.3:a:devklan:alma_blog:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
devklan	alma_blog	*	cpe:2.3:a:devklan:alma_blog::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Alma Blog",
    "vendor": "Devklan",
    "versions": [
      {
        "lessThanOrEqual": "2.1.10",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alma-devklan-blog

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-1145