CVE-2024-31218

{
  "id": "CVE-2024-31218",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-31218",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-07T17:41:26.026955Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "webhood-io",
          "product": "webhood",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.9.1"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:webhoodio:webhood:*:*:*:*:*:*:*:*"
          ],
          "vendor": "webhoodio",
          "product": "webhood",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "0.9.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-04-05T15:15:07.863",
  "references": [
    {
      "url": "https://github.com/webhood-io/webhood/commit/735e7fa2814edeec9a2c07778ed51b3c018609f9",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/webhood-io/webhood/security/advisories/GHSA-h533-rxhm-73j2",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/webhood-io/webhood/commit/735e7fa2814edeec9a2c07778ed51b3c018609f9",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/webhood-io/webhood/security/advisories/GHSA-h533-rxhm-73j2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Webhood is a self-hosted URL scanner used analyzing phishing and malicious sites. Webhood's backend container images in versions 0.9.0 and earlier are subject to Missing Authentication for Critical Function vulnerability. This vulnerability allows an unauthenticated attacker to send a HTTP request to the database (Pocketbase) admin API to create an admin account. The Pocketbase admin API does not check for authentication/authorization when creating an admin account when no admin accounts have been added. In its default deployment, Webhood does not create a database admin account. Therefore, unless users have manually created an admin account in the database, an admin account will not exist in the deployment and the deployment is vulnerable. Versions starting from 0.9.1 are patched. The patch creates a randomly generated admin account if admin accounts have not already been created i.e. the vulnerability is exploitable in the deployment. As a workaround, users can disable access to URL path starting with `/api/admins` entirely. With this workaround, the vulnerability is not exploitable via network."
    },
    {
      "lang": "es",
      "value": "Webhood es un escáner de URL autohospedado que se utiliza para analizar sitios maliciosos y de phishing. Las imágenes del contenedor backend de Webhood en las versiones 0.9.0 y anteriores están sujetas a una vulnerabilidad de autenticación faltante para funciones críticas. Esta vulnerabilidad permite que un atacante no autenticado envíe una solicitud HTTP a la API de administración de la base de datos (Pocketbase) para crear una cuenta de administrador. La API de administración de Pocketbase no verifica la autenticación/autorización al crear una cuenta de administrador cuando no se han agregado cuentas de administrador. En su implementación predeterminada, Webhood no crea una cuenta de administrador de base de datos. Por lo tanto, a menos que los usuarios hayan creado manualmente una cuenta de administrador en la base de datos, no existirá una cuenta de administrador en la implementación y la implementación es vulnerable. Las versiones a partir de 0.9.1 están parcheadas. El parche crea una cuenta de administrador generada aleatoriamente si aún no se han creado cuentas de administrador, es decir, la vulnerabilidad se puede explotar en la implementación. Como workaround, los usuarios pueden deshabilitar completamente el acceso a la ruta URL que comienza con `/api/admins`. Con esta workaround, la vulnerabilidad no se puede explotar a través de la red."
    }
  ],
  "lastModified": "2026-06-17T07:28:00.280",
  "sourceIdentifier": "security-advisories@github.com"
}