PT-2024-20520 · Gibbon · Gibbon
Ali Maharramli
+2
·
Published
2024-03-23
·
Updated
2025-07-29
·
CVE-2024-24725
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Gibbon versions 26.0.00 and earlier
Description
The issue allows remote authenticated users to conduct PHP deserialization attacks via the
columnOrder parameter in a POST request to the "/modules/System%20Admin/import run.php&type=externalAssessment&step=4" API endpoint. This can lead to deserialization attacks. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.Recommendations
For Gibbon versions 26.0.00 and earlier, restrict access to the System Admin module and consider patching as soon as possible to mitigate the risk of exploitation. As a temporary workaround, consider restricting the use of the
columnOrder parameter in the affected API endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gibbon