CVE-2026-113388

Estado: RecibidaBaja (1.9)—

Gravedad1.9Baja · CVSS 4.0

Probabilidad de explotación—en los próximos 30 días

Explotación activaNono figura en el catálogo de CISA

Exploit públicoNo conocidosin código público localizado

Se ha descubierto un fallo de seguridad en opensource-socialnetwork hasta la versión 9.11/10.1. Afecta a la función input del archivo actions/administrator/cache/dynamic.php del componente Cache Settings. Al manipular el argumento host/port/username/password/type/status se produce una inyección de código. El ataque puede iniciarse de forma remota. El exploit se ha publicado y puede utilizarse para realizar ataques. El parche se denomina 40945057cb451f0f35153110bc7e889c094400e1. La acción recomendada para corregir este problema es aplicar el parche.

Leer descripción completaMostrar menos

El proveedor explica: "Aunque hemos implementado este parche como medida de defensa en profundidad, subrayamos que en Open Source Social Network (OSSN), los administradores del sitio son usuarios plenamente de confianza a los que, por diseño, se les concede intencionadamente una amplia autoridad sobre el sistema, incluida la capacidad nativa de subir componentes/temas personalizados que contengan código PHP arbitrario."

Traducción automática del texto original de NVD (en inglés).

CVSS

Puntuación base: 1.9
Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Probabilidad de explotación (EPSS)

FIRST aún no ha puntuado esta CVE (habitual en CVEs muy recientes o rechazadas).

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1203 Exploitation for Client Executionexecution60 %
Impacto principalT1059 Command and Scripting Interpreterexecution55 %

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

Mitigaciones ATT&CK que cubren estas técnicas

Restrict Web-Based Content Privileged Account Management Limit Software Installation Execution Prevention Behavior Prevention on Endpoint Disable or Remove Feature or Program

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Opensource-socialnetwork — Opensource-socialnetwork^AI

CWE

CWE-74, CWE-94

Referencias

Mostrar las 7 referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-113388",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P",
          "authentication": "MULTIPLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 0.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 1.9,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cna@vuldb.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:opensource-socialnetwork:opensource-socialnetwork:*:*:*:*:*:*:*:*"
          ],
          "vendor": "n/a",
          "modules": [
            "Cache Settings"
          ],
          "product": "opensource-socialnetwork",
          "versions": [
            {
              "status": "affected",
              "version": "9.0"
            },
            {
              "status": "affected",
              "version": "9.1"
            },
            {
              "status": "affected",
              "version": "9.2"
            },
            {
              "status": "affected",
              "version": "9.3"
            },
            {
              "status": "affected",
              "version": "9.4"
            },
            {
              "status": "affected",
              "version": "9.5"
            },
            {
              "status": "affected",
              "version": "9.6"
            },
            {
              "status": "affected",
              "version": "9.7"
            },
            {
              "status": "affected",
              "version": "9.8"
            },
            {
              "status": "affected",
              "version": "9.9"
            },
            {
              "status": "affected",
              "version": "9.10"
            },
            {
              "status": "affected",
              "version": "9.11"
            },
            {
              "status": "affected",
              "version": "10.0"
            },
            {
              "status": "affected",
              "version": "10.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-20T12:17:29.237",
  "references": [
    {
      "url": "https://gist.github.com/qianqiusujiu/c0452f09e91de23f002a384038325104",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/opensource-socialnetwork/opensource-socialnetwork/commit/40945057cb451f0f35153110bc7e889c094400e1",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/cve/CVE-2026-113388",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/submit/1009749",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/vuln/422662",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/vuln/422662/cti",
      "source": "cna@vuldb.com"
    }
  ],
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "cna@vuldb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        },
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/username/password/type/status results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 40945057cb451f0f35153110bc7e889c094400e1. Applying a patch is the recommended action to fix this issue. The vendor explains: \"While we have implemented this patch as a defense-in-depth measure, we emphasize that in Open Source Social Network (OSSN), site administrators are fully trusted users who are intentionally granted broad system authority by design including the native ability to upload custom components/themes containing arbitrary PHP code.\""
    }
  ],
  "lastModified": "2026-10-20T12:17:29.237",
  "sourceIdentifier": "cna@vuldb.com"
}