« Volver al listado

CVE-2024-55652

Estado: AplazadaMedia (6.5)—

PenDoc is a penetration testing reporting application. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an attacker can write a malicious docx template containing expressions that escape the JavaScript sandbox to execute arbitrary code on the system. An attacker who can control the contents of the template document is able to execute arbitrary code on the system. By default, only users with the `admin` role are able to create or update templates. Commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 patches the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Pendoc — PendocAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-55652",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-55652",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-12T16:31:10.619876Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "pwndoc",
          "product": "pwndoc",
          "versions": [
            {
              "status": "affected",
              "version": "< 1d4219c596f4f518798492e48386a20c6e9a2fe6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-12-12T02:15:32.377",
  "references": [
    {
      "url": "https://github.com/pwndoc/pwndoc/blob/main/backend/src/lib/report-filters.js#L258-L260",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pwndoc/pwndoc/commit/1d4219c596f4f518798492e48386a20c6e9a2fe6",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pwndoc/pwndoc/security/advisories/GHSA-jw5r-6927-hwpc",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/pwndoc/pwndoc/security/advisories/GHSA-jw5r-6927-hwpc",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1336"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "PenDoc is a penetration testing reporting application. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an attacker can write a malicious docx template containing expressions that escape the JavaScript sandbox to execute arbitrary code on the system. An attacker who can control the contents of the template document is able to execute arbitrary code on the system. By default, only users with the `admin` role are able to create or update templates. Commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 patches the issue."
    },
    {
      "lang": "es",
      "value": " PenDoc es una aplicación de generación de informes de pruebas de penetración. Antes de la confirmación 1d4219c596f4f518798492e48386a20c6e9a2fe6, un atacante podía escribir una plantilla docx maliciosa que contuviera expresiones que escaparan del entorno limitado de JavaScript para ejecutar código arbitrario en el sistema. Un atacante que pueda controlar el contenido del documento de plantilla puede ejecutar código arbitrario en el sistema. De forma predeterminada, solo los usuarios con el rol \"admin\" pueden crear o actualizar plantillas. La confirmación 1d4219c596f4f518798492e48386a20c6e9a2fe6 soluciona el problema."
    }
  ],
  "lastModified": "2026-06-17T08:11:20.950",
  "sourceIdentifier": "security-advisories@github.com"
}