CVE-2024-24724 in Gibbon

Riassunto

di MITRE • 03/04/2024

Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) without sanitization.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Prenotare: 27/01/2024
• Divulgazione: 03/04/2024
• Moderazione: accettato
• Voce: VDB-259081
• CPE: pronto
• CWE: CWE-74 (confermato)
• Sfruttamento: Scaricare
• CVSS: 9.8 (CNA)
• EPSS: 0.26089
• KEV: no
• Attività: molto basso

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2024-24724
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-24724
• CVE Details: https://www.cvedetails.com/cve/CVE-2024-24724/