CVE-2024-12667

Published: Dic 16, 2024 Last Modified: Dic 19, 2024 EU-VD ID: EUVD-2024-51041
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,3
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
LOW 3,7
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: none
Availability: none
LOW 2,6
Source: [email protected]
Access Vector: network
Access Complexity: high
Authentication: none
Confidentiality: partial
Integrity: none
Availability: none

Description

AI Translation Available

A vulnerability was found in InvoicePlane up to 1.6.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /invoices/view. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.6.2-beta-1 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0011
Percentile
0,3th
Updated

EPSS Score Trend (Last 90 Days)

613

Insufficient Session Expiration

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Applicable Platforms
Technologies: Web Based, Web Server
View CWE Details
Application

Invoiceplane by Invoiceplane

Product Information
Vendor Invoiceplane
Product Invoiceplane
Version Range Affected
To 1.6.1 (inclusive)
cpe:2.3:a:invoiceplane:invoiceplane:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://github.com/InvoicePlane/InvoicePlane/releases/tag/v…
Release Notes
https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.6.2-beta-1
https://vuldb.com/?ctiid.288536
Permissions Required VDB Entry
https://vuldb.com/?ctiid.288536
https://vuldb.com/?id.288536
Third Party Advisory VDB Entry
https://vuldb.com/?id.288536
https://vuldb.com/?submit.449923
Third Party Advisory VDB Entry
https://vuldb.com/?submit.449923