CVE-2024-5351
Assigner: VulDB
Published: 2024-05-26T00:00:06.021Z
State: PUBLISHED
title: anji-plus AJ-Report Javascript getValueFromJs deserialization
problemTypes: descriptions: type: CWE
cweId: CWE-502
description: CWE-502 Deserialization
affected: vendor: anji-plus
product: AJ-Report
versions: version: 1.4.0
status: affected
version: 1.4.1
status: affected
modules: Javascript Handler
descriptions: value: A vulnerability was found in anji-plus AJ-Report up to 1.4.1. It has been declared as critical. Affected by this vulnerability is the function getValueFromJs of the component Javascript Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-266263.
value: In anji-plus AJ-Report bis 1.4.1 wurde eine kritische Schwachstelle ausgemacht. Dabei geht es um die Funktion getValueFromJs der Komponente Javascript Handler. Durch Manipulieren mit unbekannten Daten kann eine deserialization-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.
metrics: cvssV4_0: version: 4.0
baseScore: 5.3
vectorString: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
baseSeverity: MEDIUM
cvssV3_1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
cvssV3_0: version: 3.0
baseScore: 6.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
baseSeverity: MEDIUM
cvssV2_0: version: 2.0
baseScore: 6.5
vectorString: AV:N/AC:L/Au:S/C:P/I:P/A:P
timeline: time: 2024-05-25T00:00:00.000Z
value: Advisory disclosed
time: 2024-05-25T02:00:00.000Z
value: VulDB entry created
time: 2024-05-25T07:42:20.000Z
value: VulDB entry last update