PT-2024-24060 · Clavister · Clavister E80+1

Strik3R · Published 2024-04-02 · Updated 2024-05-17 · CVE-2024-3142

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Clavister E10 and E80 versions up to 14.00.10

Description A vulnerability was found in the Setting Handler component, leading to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations For Clavister E10 and E80 versions up to 14.00.10, upgrade to version 14.00.11 to address this issue. As a temporary workaround, consider disabling the Setting Handler component until a patch is available.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-3142

Affected Products

Clavister E10

Clavister E80

References · 9

• 🔥 https://github.com/strik3r0x1/Vulns/blob/main/CSRF_Clavister-E80,E10.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-3142 · Security Note
• https://my.clavister.com/downloads/?sid=1 · Patch
• https://vuldb.com/?id.258917 · Note
• https://vuldb.com/?ctiid.258917 · Note
• https://vuldb.com/?submit.303530 · Note
• https://t.me/cvenotify/75725 · Telegram Post
• https://docs.clavister.com/repo/cos-core-release-notes/doc/index.html#d0e2260 · Note
• https://t.me/cvenotify/75622 · Telegram Post