Lucene search

VulDBVULNRICHMENT:CVE-2024-7437

HistoryAug 03, 2024 - 2:31 p.m.

CVE-2024-7437 SimpleMachines SMF Delete User index.php resource injection

2024-08-0314:31:04

CWE-99

VulDB

github.com

simplemachines smf

vulnerability

delete user handler

remote attack

resource injection

index.php

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CVSS4

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/SC:N/VI:L/SI:N/VA:L/SA:N

EPSS

0.001

Percentile

51.1%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

A vulnerability, which was classified as critical, was found in SimpleMachines SMF 2.1.4. Affected is an unknown function of the file /index.php?action=profile;u=2;area=showalerts;do=remove of the component Delete User Handler. The manipulation of the argument aid leads to improper control of resource identifiers. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CNA Affected

[
  {
    "vendor": "SimpleMachines",
    "modules": [
      "Delete User Handler"
    ],
    "product": "SMF",
    "versions": [
      {
        "status": "affected",
        "version": "2.1.4"
      }
    ]
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:simplemachines:simple_machine_forum:-:*:*:*:*:*:*:*"
    ],
    "vendor": "simplemachines",
    "product": "simple_machine_forum",
    "versions": [
      {
        "status": "affected",
        "version": "2.1.4"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

github.com/Fewword/Poc/blob/main/smf/smf-poc1.md

vuldb.com/?ctiid.273522

vuldb.com/?id.273522

vuldb.com/?submit.380189

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CVSS4

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/SC:N/VI:L/SI:N/VA:L/SA:N

EPSS

0.001

Percentile

51.1%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-7437