SysReptor CSRF Vulnerability Affects WebSocket Connections
CVE-2024-36076

8.8HIGH

Key Information:

Vendor

Syslifters

Vendor
CVE Published:
19 May 2024

What is CVE-2024-36076?

A vulnerability has been identified in SysReptor, specifically affecting versions 2024.28 through 2024.30. This issue allows attackers to perform Cross-Site WebSocket Hijacking, which can lead to privilege escalation and unauthorized access to sensitive information. The vulnerability is triggered when a logged-in SysReptor user interacts with a malicious same-site subdomain within the same browser session, resulting in potential data compromise. It is crucial for users of the affected versions to apply the latest security updates to mitigate risks associated with this vulnerability.

References

https://github.com/Syslifters/sysreptor/releases/tag/2024.40
https://github.com/Syslifters/sysreptor/security/advisori...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.