« Volver al listado

CVE-2024-28736

Estado: AplazadaAlta (7.1)—

Un problema en Debezium Community debezium-ui v.2.5 permite a un atacante local ejecutar código arbitrario a través de la función de actualización de página.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Debezium — Debezium-uiAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-28736",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-28736",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-06T17:17:46.783014Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:debezium_community_project:debezium-ui:2.5:*:*:*:*:*:*:*"
          ],
          "vendor": "debezium_community_project",
          "product": "debezium-ui",
          "versions": [
            {
              "status": "affected",
              "version": "2.5"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-31T16:15:09.360",
  "references": [
    {
      "url": "https://packetstormsecurity.com/files/178794/Debezium-UI-2.5-Credential-Disclosure.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://packetstormsecurity.com/files/178794/Debezium-UI-2.5-Credential-Disclosure.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-256"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue in Debezium Community debezium-ui v.2.5 allows a local attacker to execute arbitrary code via the refresh page function."
    },
    {
      "lang": "es",
      "value": "Un problema en Debezium Community debezium-ui v.2.5 permite a un atacante local ejecutar código arbitrario a través de la función de actualización de página."
    }
  ],
  "lastModified": "2026-06-17T07:21:42.647",
  "sourceIdentifier": "cve@mitre.org"
}