« Volver al listado

CVE-2024-35361

Estado: AplazadaCrítica (9.8)—

MTab Bookmark v1.9.5 tiene una vulnerabilidad de inyección SQL en /LinkStore/getIcon. Un atacante puede ejecutar declaraciones SQL arbitrarias a través de esta vulnerabilidad sin requerir ningún derecho de usuario.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Mtab Bookmark — Mtab BookmarkAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-35361",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-35361",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-21T17:40:07.859596Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:mtab:bookmark:1.9.5:*:*:*:*:*:*:*"
          ],
          "vendor": "mtab",
          "product": "bookmark",
          "versions": [
            {
              "status": "affected",
              "version": "1.9.5"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-21T13:15:09.057",
  "references": [
    {
      "url": "https://github.com/Hebing123/cve/issues/37",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/Hebing123/cve/issues/37",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "MTab Bookmark v1.9.5 has an SQL injection vulnerability in /LinkStore/getIcon. An attacker can execute arbitrary SQL statements through this vulnerability without requiring any user rights."
    },
    {
      "lang": "es",
      "value": "MTab Bookmark v1.9.5 tiene una vulnerabilidad de inyección SQL en /LinkStore/getIcon. Un atacante puede ejecutar declaraciones SQL arbitrarias a través de esta vulnerabilidad sin requerir ningún derecho de usuario."
    }
  ],
  "lastModified": "2026-06-17T07:34:48.890",
  "sourceIdentifier": "cve@mitre.org"
}