cvelistv5 - cve-2024-35180

CVE-2024-35180 (GCVE-0-2024-35180)

Vulnerability from cvelistv5 – Published: 2024-05-21 12:33 – Updated: 2024-08-02 03:07

Summary

OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has been patched in version 5.26.0.

Severity ?

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

CWE-830 - Inclusion of Web Functionality from an Untrusted Source

Assigner

GitHub_M

References

URL

Tags

	https://github.com/ome/omero-web/security/advisor…	x_refsource_CONFIRM
	https://github.com/ome/omero-web/commit/d41207cbb…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	ome	omero-web	Affected: <= 5.25.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35180",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T15:13:29.799514Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:34:51.270Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:07:46.755Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq"
          },
          {
            "name": "https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "omero-web",
          "vendor": "ome",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 5.25.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has been patched in version 5.26.0.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-830",
              "description": "CWE-830: Inclusion of Web Functionality from an Untrusted Source",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-21T12:33:02.639Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq"
        },
        {
          "name": "https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa"
        }
      ],
      "source": {
        "advisory": "GHSA-vr85-5pwx-c6gq",
        "discovery": "UNKNOWN"
      },
      "title": "OMERO.web JSONP callback vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-35180",
    "datePublished": "2024-05-21T12:33:02.639Z",
    "dateReserved": "2024-05-10T14:24:24.339Z",
    "dateUpdated": "2024-08-02T03:07:46.755Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has been patched in version 5.26.0.\\n\"}, {\"lang\": \"es\", \"value\": \" OMERO.web proporciona una infraestructura de complementos y cliente basada en web. Actualmente no existe ning\\u00fan escape ni validaci\\u00f3n del par\\u00e1metro `callback` que se pueda pasar a varios endpoints de OMERO.web que tengan JSONP habilitado. Esta vulnerabilidad ha sido parcheada en la versi\\u00f3n 5.26.0.\"}]",
      "id": "CVE-2024-35180",
      "lastModified": "2024-11-21T09:19:52.763",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 2.7}]}",
      "published": "2024-05-21T13:15:08.813",
      "references": "[{\"url\": \"https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-830\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35180\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-05-21T13:15:08.813\",\"lastModified\":\"2025-09-29T18:01:01.820\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has been patched in version 5.26.0.\\n\"},{\"lang\":\"es\",\"value\":\" OMERO.web proporciona una infraestructura de complementos y cliente basada en web. Actualmente no existe ning\u00fan escape ni validaci\u00f3n del par\u00e1metro `callback` que se pueda pasar a varios endpoints de OMERO.web que tengan JSONP habilitado. Esta vulnerabilidad ha sido parcheada en la versi\u00f3n 5.26.0.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-830\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openmicroscopy:omero-web:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.26.0\",\"matchCriteriaId\":\"55B3B018-DC74-4379-A77B-C8D54F11DD81\"}]}]}],\"references\":[{\"url\":\"https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq\", \"name\": \"https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa\", \"name\": \"https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:07:46.755Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35180\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-21T15:13:29.799514Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-21T15:13:35.541Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"OMERO.web JSONP callback vulnerability\", \"source\": {\"advisory\": \"GHSA-vr85-5pwx-c6gq\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"ome\", \"product\": \"omero-web\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c= 5.25.0\"}]}], \"references\": [{\"url\": \"https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq\", \"name\": \"https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa\", \"name\": \"https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has been patched in version 5.26.0.\\n\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-830\", \"description\": \"CWE-830: Inclusion of Web Functionality from an Untrusted Source\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-05-21T12:33:02.639Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35180\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T03:07:46.755Z\", \"dateReserved\": \"2024-05-10T14:24:24.339Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-05-21T12:33:02.639Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-VR85-5PWX-C6GQ

Vulnerability from github – Published: 2024-05-21 14:33 – Updated: 2024-05-21 15:39

Summary

OMERO.web must check that the JSONP callback is a valid function

Details

Background

There is currently no escaping or validation of the callback parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. One such endpoint is /webclient/imgData/.... As we only really use these endpoints with jQuery's own callback name generation ^1 it is quite difficult or even impossible to exploit this in vanilla OMERO.web. However, these metadata endpoints are likely to be used by many plugins.

Impact

OMERO.web before 5.25.0

Patches

Users should upgrade to 5.26.0 or higher

Workarounds

None

References

https://stackoverflow.com/questions/2777021/do-i-need-to-sanitize-the-callback-parameter-from-a-jsonp-call
https://stackoverflow.com/questions/1661197/what-characters-are-valid-for-javascript-variable-names

For more information If you have any questions or comments about this advisory:

Open an issue in omero-web Email us at security@openmicroscopy.org

Severity ?

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "omero-web"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-35180"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-830"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-21T14:33:23Z",
    "nvd_published_at": "2024-05-21T13:15:08Z",
    "severity": "MODERATE"
  },
  "details": "### Background\n\nThere is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. One such endpoint is `/webclient/imgData/...`. As we only really use these endpoints with jQuery\u0027s own callback name generation [^1] it is quite difficult or even impossible to exploit this in vanilla OMERO.web. However, these metadata endpoints are likely to be used by many plugins.\n\n[^1]: https://learn.jquery.com/ajax/working-with-jsonp/\n\n### Impact\nOMERO.web before 5.25.0\n\n### Patches\nUsers should upgrade to 5.26.0 or higher\n### Workarounds\n\nNone\n\n### References\n* https://stackoverflow.com/questions/2777021/do-i-need-to-sanitize-the-callback-parameter-from-a-jsonp-call\n* https://stackoverflow.com/questions/1661197/what-characters-are-valid-for-javascript-variable-names\n\nFor more information\nIf you have any questions or comments about this advisory:\n\nOpen an issue in [omero-web](https://github.com/ome/omero-web)\nEmail us at [security@openmicroscopy.org](mailto:security@openmicroscopy.org)\n",
  "id": "GHSA-vr85-5pwx-c6gq",
  "modified": "2024-05-21T15:39:43Z",
  "published": "2024-05-21T14:33:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35180"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ome/omero-web"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OMERO.web must check that the JSONP callback is a valid function"
}

FKIE_CVE-2024-35180

Vulnerability from fkie_nvd - Published: 2024-05-21 13:15 - Updated: 2025-09-29 18:01

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa	Patch
security-advisories@github.com	https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq	Vendor Advisory

Impacted products

	Vendor	Product	Version
	openmicroscopy	omero-web	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openmicroscopy:omero-web:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "55B3B018-DC74-4379-A77B-C8D54F11DD81",
              "versionEndExcluding": "5.26.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has been patched in version 5.26.0.\n"
    },
    {
      "lang": "es",
      "value": " OMERO.web proporciona una infraestructura de complementos y cliente basada en web. Actualmente no existe ning\u00fan escape ni validaci\u00f3n del par\u00e1metro `callback` que se pueda pasar a varios endpoints de OMERO.web que tengan JSONP habilitado. Esta vulnerabilidad ha sido parcheada en la versi\u00f3n 5.26.0."
    }
  ],
  "id": "CVE-2024-35180",
  "lastModified": "2025-09-29T18:01:01.820",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-05-21T13:15:08.813",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/ome/omero-web/commit/d41207cbb82afc56ea79e84db532608aa24ab4aa"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/ome/omero-web/security/advisories/GHSA-vr85-5pwx-c6gq"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-830"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-35180 (GCVE-0-2024-35180)

GHSA-VR85-5PWX-C6GQ

Background

Impact

Patches

Workarounds

References

FKIE_CVE-2024-35180

Tags

Sightings

Nomenclature