github - ghsa-9v62-r8m2-76m8

ghsa-9v62-r8m2-76m8

Vulnerability from github

Published

2025-01-05 09:30

Modified

2025-01-05 09:30

Severity ?

6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Details

A vulnerability was found in wangl1989 mysiteforme 1.0 and classified as critical. Affected by this issue is the function rememberMeManager of the file src/main/java/com/mysiteforme/admin/config/ShiroConfig.java. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Show details on source website

JSON

To clipboard

{
   affected: [],
   aliases: [
      "CVE-2024-13136",
   ],
   database_specific: {
      cwe_ids: [
         "CWE-20",
         "CWE-502",
      ],
      github_reviewed: false,
      github_reviewed_at: null,
      nvd_published_at: "2025-01-05T09:15:06Z",
      severity: "MODERATE",
   },
   details: "A vulnerability was found in wangl1989 mysiteforme 1.0 and classified as critical. Affected by this issue is the function rememberMeManager of the file src/main/java/com/mysiteforme/admin/config/ShiroConfig.java. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
   id: "GHSA-9v62-r8m2-76m8",
   modified: "2025-01-05T09:30:42Z",
   published: "2025-01-05T09:30:42Z",
   references: [
      {
         type: "ADVISORY",
         url: "https://nvd.nist.gov/vuln/detail/CVE-2024-13136",
      },
      {
         type: "WEB",
         url: "https://github.com/wangl1989/mysiteforme/issues/52",
      },
      {
         type: "WEB",
         url: "https://github.com/wangl1989/mysiteforme/issues/52#issue-2757682365",
      },
      {
         type: "WEB",
         url: "https://vuldb.com/?ctiid.290210",
      },
      {
         type: "WEB",
         url: "https://vuldb.com/?id.290210",
      },
      {
         type: "WEB",
         url: "https://vuldb.com/?submit.468391",
      },
   ],
   schema_version: "1.4.0",
   severity: [
      {
         score: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
         type: "CVSS_V3",
      },
      {
         score: "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
         type: "CVSS_V4",
      },
   ],
}

cve-2024-13136

Vulnerability from cvelistv5

Published

2025-01-05 09:00

Modified

2025-01-06 15:56

Severity ?

5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
6.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Summary

References

▼	URL	Tags
	https://vuldb.com/?id.290210	vdb-entry, technical-description
	https://vuldb.com/?ctiid.290210	signature, permissions-required
	https://vuldb.com/?submit.468391	third-party-advisory
	https://github.com/wangl1989/mysiteforme/issues/52	issue-tracking
	https://github.com/wangl1989/mysiteforme/issues/52#issue-2757682365	exploit, issue-tracking

Impacted products

	Vendor	Product	Version
	wangl1989	mysiteforme	Version: 1.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-13136",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-01-06T15:55:33.388966Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-01-06T15:56:04.087Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "mysiteforme",
               vendor: "wangl1989",
               versions: [
                  {
                     status: "affected",
                     version: "1.0",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "reporter",
               value: "LVZC (VulDB User)",
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability was found in wangl1989 mysiteforme 1.0 and classified as critical. Affected by this issue is the function rememberMeManager of the file src/main/java/com/mysiteforme/admin/config/ShiroConfig.java. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
            },
            {
               lang: "de",
               value: "Eine Schwachstelle wurde in wangl1989 mysiteforme 1.0 gefunden. Sie wurde als kritisch eingestuft. Davon betroffen ist die Funktion rememberMeManager der Datei src/main/java/com/mysiteforme/admin/config/ShiroConfig.java. Durch Manipulieren mit unbekannten Daten kann eine deserialization-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.",
            },
         ],
         metrics: [
            {
               cvssV4_0: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
                  version: "4.0",
               },
            },
            {
               cvssV3_1: {
                  baseScore: 6.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                  version: "3.1",
               },
            },
            {
               cvssV3_0: {
                  baseScore: 6.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                  version: "3.0",
               },
            },
            {
               cvssV2_0: {
                  baseScore: 6.5,
                  vectorString: "AV:N/AC:L/Au:S/C:P/I:P/A:P",
                  version: "2.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "Deserialization",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-20",
                     description: "Improper Input Validation",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-01-05T09:00:15.361Z",
            orgId: "1af790b2-7ee1-4545-860a-a788eba489b5",
            shortName: "VulDB",
         },
         references: [
            {
               name: "VDB-290210 | wangl1989 mysiteforme ShiroConfig.java rememberMeManager deserialization",
               tags: [
                  "vdb-entry",
                  "technical-description",
               ],
               url: "https://vuldb.com/?id.290210",
            },
            {
               name: "VDB-290210 | CTI Indicators (IOB, IOC, IOA)",
               tags: [
                  "signature",
                  "permissions-required",
               ],
               url: "https://vuldb.com/?ctiid.290210",
            },
            {
               name: "Submit #468391 | wangl1989 mysiteforme 1.0 Remote Command Execution",
               tags: [
                  "third-party-advisory",
               ],
               url: "https://vuldb.com/?submit.468391",
            },
            {
               tags: [
                  "issue-tracking",
               ],
               url: "https://github.com/wangl1989/mysiteforme/issues/52",
            },
            {
               tags: [
                  "exploit",
                  "issue-tracking",
               ],
               url: "https://github.com/wangl1989/mysiteforme/issues/52#issue-2757682365",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2025-01-04T00:00:00.000Z",
               value: "Advisory disclosed",
            },
            {
               lang: "en",
               time: "2025-01-04T01:00:00.000Z",
               value: "VulDB entry created",
            },
            {
               lang: "en",
               time: "2025-01-04T10:53:44.000Z",
               value: "VulDB entry last update",
            },
         ],
         title: "wangl1989 mysiteforme ShiroConfig.java rememberMeManager deserialization",
      },
   },
   cveMetadata: {
      assignerOrgId: "1af790b2-7ee1-4545-860a-a788eba489b5",
      assignerShortName: "VulDB",
      cveId: "CVE-2024-13136",
      datePublished: "2025-01-05T09:00:15.361Z",
      dateReserved: "2025-01-04T09:48:31.422Z",
      dateUpdated: "2025-01-06T15:56:04.087Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted