PT-2024-23674 · Derbynet · Derbynet

Chocapikk + 1 · Published 2024-04-05 · Updated 2024-11-22 · CVE-2024-30924

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DerbyNet versions 9.0 and below

Description A Cross Site Scripting issue allows attackers to execute arbitrary code via the "checkin.php" component. This enables attackers to perform malicious actions on the affected system.

Recommendations For DerbyNet versions 9.0 and below, consider disabling the "checkin.php" component until a patch is available to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-692

Related Identifiers

CVE-2024-30924

Affected Products

Derbynet

References · 9

• 🔥 https://chocapikk.com/posts/2024/derbynet-vulnerabilities · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-30924 · Security Note
• https://osv.dev/vulnerability/CVE-2024-30924 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1781117350411902980 · Twitter Post
• https://twitter.com/buaqbot/status/1776306487335272737 · Twitter Post
• http://seclists.org/fulldisclosure/2024/Apr/10 · Note
• https://twitter.com/CVEnew/status/1781102378458153141 · Twitter Post
• https://t.me/cvenotify/77422 · Telegram Post
• https://t.me/cvenotify/77362 · Telegram Post