AMPPS Encryption Passphrase Handler Vulnerability Could Lead to Remote Denial of Service
CVE-2024-1189

5.3MEDIUM

Key Information:

Vendor

AMPPS

Status
Ampps
Vendor
CVE Published:
2 February 2024

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-1189?

A vulnerability exists within the AMPPS 2.7 platform that affects the Encryption Passphrase Handler, which can be exploited to cause a denial of service. This vulnerability can be triggered remotely, allowing attackers to disrupt service without needing physical access to the system. The issue has been made public, raising concerns about its exploitation potential. To mitigate risks associated with this vulnerability, users are strongly advised to upgrade to AMPPS version 4.0, which includes a complete code rewrite addressing this and other issues.

Affected Version(s)

AMPPS 2.7

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-1189 - Proof of Concept

References

https://vuldb.com/?id.252679
vdb-entry
https://vuldb.com/?ctiid.252679
signaturepermissions-required
https://fitoxs.com/vuldb/15-exploit-perl.txt
exploit

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

fernando.mengali (VulDB User)
.