CVE-2024-0412

A vulnerability was found in DeShang DSShop up to 3.1.0. It has been declared as problematic. This vulnerability affects unknown code of the file public/install.php of the component HTTP GET Request Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250432.

CVSS v3 9.8 CRITICAL
CVSS v2.0 5.0 MEDIUM

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://note.zhaoj.in/share/Q56cf5nN9RzF	Broken Link
https://vuldb.com/?ctiid.250432	Permissions Required Third Party Advisory VDB Entry
https://vuldb.com/?id.250432	Permissions Required Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:csdeshang:dsshop:3.0:::::::*
	cpe:2.3:a:csdeshang:dsshop:3.1.0:::::::*

History

18 Jan 2024, 20:20

Type	Values Removed	Values Added
CPE		cpe:2.3:a:csdeshang:dsshop:3.0:::::::* cpe:2.3:a:csdeshang:dsshop:3.1.0:::::::*
References	~~() https://vuldb.com/?id.250432 -~~	() https://vuldb.com/?id.250432 - Permissions Required, Third Party Advisory, VDB Entry
References	~~() https://vuldb.com/?ctiid.250432 -~~	() https://vuldb.com/?ctiid.250432 - Permissions Required, Third Party Advisory, VDB Entry
References	~~() https://note.zhaoj.in/share/Q56cf5nN9RzF -~~	() https://note.zhaoj.in/share/Q56cf5nN9RzF - Broken Link
First Time		Csdeshang Csdeshang dsshop
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8

11 Jan 2024, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-01-11 17:15

Updated : 2024-05-17 02:34

NVD link : CVE-2024-0412

Mitre link : CVE-2024-0412

CVE.ORG link : CVE-2024-0412

JSON object : View

Products Affected

csdeshang

dsshop

CWE

CWE-284

Improper Access Control

{"id": "CVE-2024-0412", "metrics": {"cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-01-11T17:15:08.843", "references": [{"url": "https://note.zhaoj.in/share/Q56cf5nN9RzF", "tags": ["Broken Link"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?ctiid.250432", "tags": ["Permissions Required", "Third Party Advisory", "VDB Entry"], "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.250432", "tags": ["Permissions Required", "Third Party Advisory", "VDB Entry"], "source": "cna@vuldb.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in DeShang DSShop up to 3.1.0. It has been declared as problematic. This vulnerability affects unknown code of the file public/install.php of the component HTTP GET Request Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250432."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en DeShang DSShop hasta 3.1.0. Ha sido declarada problem\u00e1tica. Esta vulnerabilidad afecta a un c\u00f3digo desconocido del archivo public/install.php del componente HTTP GET Request Handler. La manipulaci\u00f3n conduce a controles de acceso inadecuados. El ataque se puede iniciar de forma remota. La explotaci\u00f3n ha sido divulgada al p\u00fablico y puede utilizarse. El identificador de esta vulnerabilidad es VDB-250432."}], "lastModified": "2024-05-17T02:34:35.707", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:csdeshang:dsshop:3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CDA7CDD3-CA8A-44D7-AA3E-D1FE4D5471E9"}, {"criteria": "cpe:2.3:a:csdeshang:dsshop:3.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2EC91B69-2B20-40C6-80EF-00AD1469A5C1"}], "operator": "OR"}]}], "sourceIdentifier": "cna@vuldb.com"}