2 lines
2.8 KiB
JSON
2 lines
2.8 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"affected","product":"Mautic","programFiles":["https://github.com/mautic/mautic/blob/4.4.9/plugins/MauticFocusBundle/Controller/AjaxController.php#L17"],"repo":"https://github.com/mautic/mautic","vendor":"Mautic","versions":[{"lessThanOrEqual":"4.4.9","status":"affected","version":"0","versionType":"semver"}]}],"source":"vulnerability@ncsc.ch"},{"affectedData":[{"cpes":["cpe:2.3:a:mautic:mautic:-:*:*:*:*:*:*:*"],"defaultStatus":"unknown","product":"mautic","vendor":"mautic","versions":[{"lessThanOrEqual":"4.4.9","status":"affected","version":"0","versionType":"custom"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Users with low privileges can perform certain AJAX actions. In this vulnerability instance, improper access to ajax?action=plugin:focus:checkIframeAvailability leads to a Server-Side Request Forgery by analyzing the error messages returned from the back-end. Allowing an attacker to perform a port scan in the back-end. At the time of publication of the CVE no patch is available.\n\n"},{"lang":"es","value":"Los usuarios con pocos privilegios pueden realizar ciertas acciones AJAX. En este caso de vulnerabilidad, el acceso inadecuado a ajax?action=plugin:focus:checkIframeAvailability conduce a Server-Side Request Forgery al analizar los mensajes de error devueltos desde el back-end. Permitir que un atacante realice un escaneo de puertos en el back-end. En el momento de publicación del CVE no hay ningún parche disponible."}],"id":"CVE-2024-3448","lastModified":"2026-06-17T07:44:17.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.0,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":1.4,"source":"vulnerability@ncsc.ch","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-3448","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-04-11T17:28:32.074277Z","version":"2.0.3"}}]},"published":"2024-04-10T14:15:07.937","references":[{"source":"vulnerability@ncsc.ch","url":"https://huntr.com/bounties/4d72d300-92d6-4e3c-93d8-52fe47396ae0"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://huntr.com/bounties/4d72d300-92d6-4e3c-93d8-52fe47396ae0"}],"sourceIdentifier":"vulnerability@ncsc.ch","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"vulnerability@ncsc.ch","type":"Secondary"}]}
|