CVE-2024-7438
SimpleMachines SMF User Alert Read Status index.php resource injection
- State
- Published
- Severity
- 5.3 Medium
- Published
- Aug 3, 2024
- Updated
- Aug 10, 2024
- Reserved
- Aug 2, 2024
Description
A vulnerability has been found in SimpleMachines SMF 2.1.4 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php?action=profile;u=2;area=showalerts;do=read of the component User Alert Read Status Handler. The manipulation of the argument aid leads to improper control of resource identifiers. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N | VulDB |
| 2.0 | 4.0 Medium | AV:N/AC:L/Au:S/C:N/I:P/A:N | VulDB |
Weaknesses
- CWE-99 Improper Control of Resource Identifiers
Affected Products
| Product | Versions |
|---|---|
SMFSimpleMachines |
|
References
- VDB-273523 | SimpleMachines SMF User Alert Read Status index.php resource injectionvdb-entrytechnical-description
- VDB-273523 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- Submit #380190 | SimpleMachines SMF 2.1.4 Insecure Direct Object Referencethird-party-advisory
- https://github.com/Fewword/Poc/blob/main/smf/smf-poc2.mdexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.