by Kastro
Paper/Archive/CVE-2024-13136

CVE-2024-13136

wangl1989 mysiteforme — wangl1989 mysiteforme ShiroConfig.java rememberMeManager deserialization

EPSS 0.6%public exploitCVSS 9.8
critical.is priorityof 100
50
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 50.4.504 × 2010.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability was found in wangl1989 mysiteforme 1.0 and classified as critical. Affected by this issue is the function rememberMeManager of the file src/main/java/com/mysiteforme/admin/config/ShiroConfig.java. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Affected

ProductAffectedFixed inSource
mysiteforme1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
VulDB (CNA)6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
VulDB (CNA)5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

writeupvuldb.com/?id.290210refvuldb.com/?ctiid.290210writeupvuldb.com/?submit.468391refgithub.com/wangl1989/mysiteforme/issues/52exploitgithub.com/wangl1989/mysiteforme/issues/52#issue-2757682365