CVE-2024-12666

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-12666
A vulnerability has been found in ClassCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin?do=admin:user:editPost of the component User Management Page. The manipulation leads to improper handling of insufficient privileges. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

5.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:M/C:P/I:P/A:P

Exploitability : 6.4 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication MULTIPLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://github.com/Jack-Black-13/blob/blob/main/ClassCMS%20V4.8%20Vertical%20Privilege%20Escalation.md Exploit Third Party Advisory
https://vuldb.com/?ctiid.288535 Permissions Required VDB Entry
https://vuldb.com/?id.288535 Third Party Advisory VDB Entry
https://vuldb.com/?submit.461120 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:classcms:classcms:*:*:*:*:*:*:*:*
History

19 Dec 2024, 15:01

Type Values Removed Values Added
First Time Classcms classcms
Classcms
CPE cpe:2.3:a:classcms:classcms:*:*:*:*:*:*:*:*
References () https://github.com/Jack-Black-13/blob/blob/main/ClassCMS%20V4.8%20Vertical%20Privilege%20Escalation.md - () https://github.com/Jack-Black-13/blob/blob/main/ClassCMS%20V4.8%20Vertical%20Privilege%20Escalation.md - Exploit, Third Party Advisory
References () https://vuldb.com/?ctiid.288535 - () https://vuldb.com/?ctiid.288535 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.288535 - () https://vuldb.com/?id.288535 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.461120 - () https://vuldb.com/?submit.461120 - Third Party Advisory, VDB Entry
CWE NVD-CWE-noinfo
Summary
  • (es) Se ha detectado una vulnerabilidad en ClassCMS hasta la versión 4.8 y se ha clasificado como crítica. Esta vulnerabilidad afecta a una funcionalidad desconocida del archivo /admin?do=admin:user:editPost del componente User Management Page. La manipulación conduce a un manejo inadecuado de privilegios insuficientes. El ataque puede ejecutarse de forma remota. El exploit ha sido divulgado al público y puede utilizarse.

16 Dec 2024, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-16 20:15

Updated : 2024-12-19 15:01

NVD link : CVE-2024-12666

Mitre link : CVE-2024-12666

CVE.ORG link : CVE-2024-12666

JSON object : View

Products Affected

classcms

  • classcms
CWE
CWE-266

Incorrect Privilege Assignment

CWE-274

Improper Handling of Insufficient Privileges

NVD-CWE-noinfo