CVE-2024-6947

A vulnerability was found in Flute CMS 0.2.2.4-alpha. It has been rated as critical. This issue affects the function replaceContent of the file app/Core/Support/ContentParser.php of the component Notification Handler. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272069 was assigned to this vulnerability.

CVSS v3 4.7 MEDIUM
CVSS v2.0 5.8 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

5.8^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:M/C:P/I:P/A:P

Exploitability : 6.4 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication MULTIPLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/DeepMountains/Mirage/blob/main/CVE5-3.md	Broken Link
https://vuldb.com/?ctiid.272069	Permissions Required
https://vuldb.com/?id.272069	Third Party Advisory
https://vuldb.com/?submit.376785	Third Party Advisory
https://github.com/DeepMountains/Mirage/blob/main/CVE5-3.md	Broken Link
https://vuldb.com/?ctiid.272069	Permissions Required
https://vuldb.com/?id.272069	Third Party Advisory
https://vuldb.com/?submit.376785	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:flute-cms:flute:0.2.2.4:alpha:*:*:*:*:*:*

History

21 Nov 2024, 09:50

Type	Values Removed	Values Added
CVSS	v2 : ~~5.8~~ v3 : ~~8.8~~	v2 : 5.8 v3 : 4.7
References	~~() https://github.com/DeepMountains/Mirage/blob/main/CVE5-3.md - Broken Link~~	() https://github.com/DeepMountains/Mirage/blob/main/CVE5-3.md - Broken Link
References	~~() https://vuldb.com/?ctiid.272069 - Permissions Required~~	() https://vuldb.com/?ctiid.272069 - Permissions Required
References	~~() https://vuldb.com/?id.272069 - Third Party Advisory~~	() https://vuldb.com/?id.272069 - Third Party Advisory
References	~~() https://vuldb.com/?submit.376785 - Third Party Advisory~~	() https://vuldb.com/?submit.376785 - Third Party Advisory

05 Sep 2024, 16:14

Type	Values Removed	Values Added
CPE		cpe:2.3:a:flute-cms:flute:0.2.2.4:alpha::::::
CVSS	v2 : ~~5.8~~ v3 : ~~4.7~~	v2 : 5.8 v3 : 8.8
References	~~() https://github.com/DeepMountains/Mirage/blob/main/CVE5-3.md -~~	() https://github.com/DeepMountains/Mirage/blob/main/CVE5-3.md - Broken Link
References	~~() https://vuldb.com/?ctiid.272069 -~~	() https://vuldb.com/?ctiid.272069 - Permissions Required
References	~~() https://vuldb.com/?id.272069 -~~	() https://vuldb.com/?id.272069 - Third Party Advisory
References	~~() https://vuldb.com/?submit.376785 -~~	() https://vuldb.com/?submit.376785 - Third Party Advisory
First Time		Flute-cms Flute-cms flute

22 Jul 2024, 13:00

Type	Values Removed	Values Added
Summary		(es) Se encontró una vulnerabilidad en Flute CMS 0.2.2.4-alpha. Ha sido calificada como crítica. Este problema afecta la función replaceContent del archivo app/Core/Support/ContentParser.php del componente Notification Handler. La manipulación conduce a la inyección de código. El ataque puede iniciarse de forma remota. El exploit ha sido divulgado al público y puede utilizarse. A esta vulnerabilidad se le asignó el identificador VDB-272069.

21 Jul 2024, 09:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-07-21 09:15

Updated : 2024-11-21 09:50

NVD link : CVE-2024-6947

Mitre link : CVE-2024-6947

CVE.ORG link : CVE-2024-6947

JSON object : View

Products Affected

flute-cms

flute

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2024-6947", "metrics": {"cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P", "authentication": "MULTIPLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 5.1, "automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "NONE", "vulnerableSystemIntegrity": "LOW", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "vulnerableSystemAvailability": "LOW", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "LOW", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-07-21T09:15:03.267", "references": [{"url": "https://github.com/DeepMountains/Mirage/blob/main/CVE5-3.md", "tags": ["Broken Link"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?ctiid.272069", "tags": ["Permissions Required"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.272069", "tags": ["Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?submit.376785", "tags": ["Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "https://github.com/DeepMountains/Mirage/blob/main/CVE5-3.md", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://vuldb.com/?ctiid.272069", "tags": ["Permissions Required"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://vuldb.com/?id.272069", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://vuldb.com/?submit.376785", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Flute CMS 0.2.2.4-alpha. It has been rated as critical. This issue affects the function replaceContent of the file app/Core/Support/ContentParser.php of the component Notification Handler. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272069 was assigned to this vulnerability."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en Flute CMS 0.2.2.4-alpha. Ha sido calificada como cr\u00edtica. Este problema afecta la funci\u00f3n replaceContent del archivo app/Core/Support/ContentParser.php del componente Notification Handler. La manipulaci\u00f3n conduce a la inyecci\u00f3n de c\u00f3digo. El ataque puede iniciarse de forma remota. El exploit ha sido divulgado al p\u00fablico y puede utilizarse. A esta vulnerabilidad se le asign\u00f3 el identificador VDB-272069."}], "lastModified": "2024-11-21T09:50:36.883", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:flute-cms:flute:0.2.2.4:alpha:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3CA6F1D1-169A-4F33-9CD4-38470172278E"}], "operator": "OR"}]}], "sourceIdentifier": "cna@vuldb.com"}

4.7 /10