CVE-2024-1823

A vulnerability classified as critical was found in CodeAstro Simple Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file users.php of the component Backend. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254611.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://docs.qq.com/doc/DYll0ZEFKcUdGYlNr	Exploit
https://vuldb.com/?ctiid.254611	Permissions Required
https://vuldb.com/?id.254611	Third Party Advisory
https://docs.qq.com/doc/DYll0ZEFKcUdGYlNr	Exploit
https://vuldb.com/?ctiid.254611	Permissions Required
https://vuldb.com/?id.254611	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:codeastro:simple_voting_system:1.0:*:*:*:*:*:*:*

History

07 Dec 2024, 02:59

Type	Values Removed	Values Added
CPE		cpe:2.3:a:codeastro:simple_voting_system:1.0:::::::*
First Time		Codeastro simple Voting System Codeastro
References	~~() https://docs.qq.com/doc/DYll0ZEFKcUdGYlNr -~~	() https://docs.qq.com/doc/DYll0ZEFKcUdGYlNr - Exploit
References	~~() https://vuldb.com/?ctiid.254611 -~~	() https://vuldb.com/?ctiid.254611 - Permissions Required
References	~~() https://vuldb.com/?id.254611 -~~	() https://vuldb.com/?id.254611 - Third Party Advisory
CWE		NVD-CWE-noinfo

Information

Published : 2024-02-23 16:15

Updated : 2024-12-07 02:59

NVD link : CVE-2024-1823

Mitre link : CVE-2024-1823

CVE.ORG link : CVE-2024-1823

JSON object : View

Products Affected

codeastro

simple_voting_system

CWE

CWE-284

Improper Access Control

NVD-CWE-noinfo

{"id": "CVE-2024-1823", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-02-23T16:15:48.043", "references": [{"url": "https://docs.qq.com/doc/DYll0ZEFKcUdGYlNr", "tags": ["Exploit"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?ctiid.254611", "tags": ["Permissions Required"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.254611", "tags": ["Third Party Advisory"], "source": "cna@vuldb.com"}, {"url": "https://docs.qq.com/doc/DYll0ZEFKcUdGYlNr", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://vuldb.com/?ctiid.254611", "tags": ["Permissions Required"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://vuldb.com/?id.254611", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-284"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability classified as critical was found in CodeAstro Simple Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file users.php of the component Backend. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254611."}, {"lang": "es", "value": "Una vulnerabilidad fue encontrada en CodeAstro Simple Voting System 1.0 y clasificada como cr\u00edtica. Una funci\u00f3n desconocida del archivo users.php del componente Backend es afectada por esta vulnerabilidad. La manipulaci\u00f3n conduce a controles de acceso inadecuados. El ataque se puede lanzar de forma remota. El exploit ha sido divulgado al p\u00fablico y puede utilizarse. El identificador asociado de esta vulnerabilidad es VDB-254611."}], "lastModified": "2024-12-07T02:59:16.373", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:codeastro:simple_voting_system:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A29813E6-C710-4D31-B18A-2360630F9640"}], "operator": "OR"}]}], "sourceIdentifier": "cna@vuldb.com"}