« Volver al listado

CVE-2024-37879

Estado: AplazadaMedia (4.8)—

Improper input validation in /admin/config/save in User-friendly SVN (USVN) before v1.0.12 and below allows administrators to execute arbitrary code via the fields "siteTitle", "siteIco" and "siteLogo".

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Usvn — User-friendly SVNAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-37879",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-37879",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-20T17:56:10.301429Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-09-20T17:15:14.970",
  "references": [
    {
      "url": "https://github.com/usvn/usvn/commit/6b4678954fca9635154743b95ff9c8947cf5f46f",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/usvn/usvn/releases/tag/1.0.12",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.usvn.info/2024/06/09/usvn-1.0.12",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.usvn.info/news.html",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper input validation in /admin/config/save in User-friendly SVN (USVN) before v1.0.12 and below allows administrators to execute arbitrary code via the fields \"siteTitle\", \"siteIco\" and \"siteLogo\"."
    },
    {
      "lang": "es",
      "value": "La validación de entrada incorrecta en /admin/config/save en User-friendly SVN (USVN) anterior a v1.0.12 y anteriores permite a los administradores ejecutar código arbitrario a través de los campos \"siteTitle\", \"siteIco\" y \"siteLogo\"."
    }
  ],
  "lastModified": "2026-06-17T07:38:58.423",
  "sourceIdentifier": "cve@mitre.org"
}