« Volver al listado

CVE-2024-52583

Estado: AplazadaAlta (8.2)—

The WesHacks GitHub repository provides the official Hackathon competition website source code for the Muweilah Wesgreen Hackathon. The page `schedule.html` before 17 November 2024 or commit 93dfb83 contains links to `Leostop`, a site that hosts a malicious injected JavaScript file that occurs when bootstrap is run as well as jquery. `Leostop` may be a tracking malware and creates 2 JavaScript files, but little else is known about it. The WesHacks website remove all references to `Leostop` as of 17 November 2024.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

XSS via JavaScript inyectado en schedule.html (UI:R, C:H en CVSS). Compromiso de cadena de suministro (dependencias Bootstrap/jQuery). Ejecución de código JavaScript malicioso en navegador.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict Web-Based ContentUpdate SoftwareVulnerability ScanningUser TrainingExecution PreventionBehavior Prevention on Endpoint

Tecnologías afectadas (3)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Getbootstrap — BootstrapAIJquery — JqueryAIWeshacks — WeshacksAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-52583",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-52583",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-19T15:34:10.408728Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "DefinetlyNotAI",
          "product": "WesHacks",
          "versions": [
            {
              "status": "affected",
              "version": "< 93dfb83"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-11-18T21:15:06.810",
  "references": [
    {
      "url": "https://github.com/DefinetlyNotAI/WesHacks/commit/93dfb83cb23a8d44e81dc12424ad8a5ea05e8f96",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/DefinetlyNotAI/WesHacks/commit/ea5a4112d94bfe47beb74b8a1ba9b631d10f64f0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/DefinetlyNotAI/WesHacks/security/advisories/GHSA-462m-5c66-4pmh",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-494"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The WesHacks GitHub repository provides the official Hackathon competition website source code for the Muweilah Wesgreen Hackathon. The page `schedule.html` before 17 November 2024 or commit 93dfb83 contains links to `Leostop`, a site that hosts a malicious injected JavaScript file that occurs when bootstrap is run as well as jquery. `Leostop` may be a tracking malware and creates 2 JavaScript files, but little else is known about it. The WesHacks website remove all references to `Leostop` as of 17 November 2024."
    },
    {
      "lang": "es",
      "value": "El repositorio de GitHub de WesHacks proporciona el código fuente del sitio web oficial de la competencia de hackathon para el hackathon de Muweilah Wesgreen. La página `schedule.html` antes del 17 de noviembre de 2024 o el commit 93dfb83 contiene enlaces a `Leostop`, un sitio que aloja un archivo JavaScript malicioso inyectado que se produce cuando se ejecuta bootstrap y jquery. `Leostop` puede ser un malware de seguimiento y crea 2 archivos JavaScript, pero poco más se sabe al respecto. El sitio web de WesHacks elimina todas las referencias a `Leostop` a partir del 17 de noviembre de 2024."
    }
  ],
  "lastModified": "2026-06-17T08:07:29.593",
  "sourceIdentifier": "security-advisories@github.com"
}