CVE-2024-1144
Assigner: INCIBE
Published: 2024-03-19T11:32:49.261Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Alma Blog
vendor: Devklan
versions: lessThanOrEqual: 2.1.10
status: affected
version: 0
versionType: custom
credits: type: finder
value: David Utón Amaya
datePublic: 2024-03-19T11:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: Improper access control vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow an unauthenticated user to access the application's functionalities without the need for credentials.
value: Improper access control vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow an unauthenticated user to access the application's functionalities without the need for credentials.
impacts: capecId: CAPEC-551
descriptions: value: CAPEC-551 Modify Existing Service
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-284
description: CWE-284 Improper Access Control
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: Upgrade Alma Blog to version 2.2.
value: Upgrade Alma Blog to version 2.2.
source: discovery: EXTERNAL
title: Improper Access Control at Alma Devklan Blog
x_generator: engine: Vulnogram 0.1.0-dev