CVE-2024-27631

Severity Score

6.0

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

Cross Site Request Forgery vulnerability in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via siteadmin/usergroup.php

Vulnerabilidad de Cross Site Request Forgery en GNU Savane v.3.12 y anteriores permite a un atacante remoto escalar privilegios a través de siteadmin/usergroup.php

*Credits: N/A

CVSS Scores

CISAv3.1 6.0

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

None

Automatable

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2024-02-26 CVE Reserved
2024-04-08 CVE Published
2024-04-11 EPSS Updated
2024-08-28 CVE Updated
2024-08-28 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-352: Cross-Site Request Forgery (CSRF)

CAPEC

References (3)

URL	Tag	Source
https://git.savannah.nongnu.org/cgit/administration/savane.git/commit/?h=i18n&id=d3962d3feb75467489b869204db98e2dffaaaf09
https://medium.com/%40allypetitt/how-i-found-3-cves-in-2-days-8a135eb924d3

URL	Date	SRC
https://github.com/ally-petitt/CVE-2024-27631	2024-08-28

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
-		-				-		-		-