PT-2024-38949 · Unknown · Master-Nan Sweet-Cms

Zihe · Published 2024-08-30 · Updated 2024-09-19 · CVE-2024-8334

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: master-nan Sweet-CMS up to 5f441e022b8876f07cde709c77b5be6d2f262e3f

Description: A vulnerability was found in master-nan Sweet-CMS, affecting the function LogHandler of the file middleware/log.go. The manipulation leads to improper output neutralization for logs. The attack may be initiated remotely. This issue has been rated as problematic.

Recommendations: To fix this issue, it is recommended to apply a patch. As a temporary workaround, consider disabling the LogHandler function until a patch is available. Restrict access to the middleware/log.go file to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-117

Related Identifiers

CVE-2024-8334

Affected Products

Master-Nan Sweet-Cms

References · 14

• https://github.com/master-nan/sweet-cms/commit/2024c370e6c78b07b358c9d4257fa5d1be732c38 · Patch
• https://osv.dev/vulnerability/CVE-2024-8334 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8334 · Security Note
• https://github.com/master-nan/sweet-cms/issues/3#issuecomment-2314447003 · Note
• https://github.com/master-nan/sweet-cms/issues/3 · Note
• https://vuldb.com/?id.276209 · Note
• https://twitter.com/VulmonFeeds/status/1829529655109361826 · Twitter Post
• https://t.me/cvenotify/92806 · Telegram Post
• https://vuldb.com/?ctiid.276209 · Note
• https://t.me/cvenotify/93038 · Telegram Post
• https://vuldb.com/?submit.398805 · Note
• https://twitter.com/oktsec/status/1829432452286226601 · Twitter Post
• https://t.me/cvedetector/4518 · Telegram Post
• https://twitter.com/CVEnew/status/1829503703646134412 · Twitter Post