ByteOS Network

CVE Vulnerability Details :

CVE-2024-3142

PUBLISHED

More Info Official Page

Assigner-VulDB

Assigner Org ID-1af790b2-7ee1-4545-860a-a788eba489b5

Published At-02 Apr, 2024 | 00:00

Updated At-28 Aug, 2024 | 13:25

▼CVE Numbering Authority (CNA)

Clavister E10/E80 Setting cross-site request forgery

A vulnerability was found in Clavister E10 and E80 up to 14.00.10 and classified as problematic. This issue affects some unknown processing of the component Setting Handler. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 14.00.11 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-258917 was assigned to this vulnerability.

Affected Products

Vendor

Clavister

Product

E10

Modules

Setting Handler

Versions

Affected

14.00.0
14.00.1
14.00.2
14.00.3
14.00.4
14.00.5
14.00.6
14.00.7
14.00.8
14.00.9
14.00.10

Vendor

Clavister

Product

E80

Modules

Setting Handler

Versions

Affected

14.00.0
14.00.1
14.00.2
14.00.3
14.00.4
14.00.5
14.00.6
14.00.7
14.00.8
14.00.9
14.00.10

Problem Types

Type	CWE ID	Description
CWE	CWE-352	CWE-352 Cross-Site Request Forgery

Metrics

Version	Base score	Base severity	Vector
3.1	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
3.0	4.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
2.0	5.0	N/A	AV:N/AC:L/Au:N/C:N/I:P/A:N

Credits

reporter

Strik3r (VulDB User)

Timeline

Event	Date
Countermeasure disclosed	2023-10-16 00:00:00
Advisory disclosed	2024-04-01 00:00:00
VulDB entry created	2024-04-01 02:00:00
VulDB entry last update	2024-04-04 14:47:52

References

Hyperlink	Resource
https://vuldb.com/?id.258917	vdb-entry
https://vuldb.com/?ctiid.258917	signature permissions-required
https://vuldb.com/?submit.303530	third-party-advisory
https://github.com/strik3r0x1/Vulns/blob/main/CSRF_Clavister-E80,E10.md	exploit
https://docs.clavister.com/repo/cos-core-release-notes/doc/index.html#d0e2260	related
https://my.clavister.com/downloads/?sid=1	patch

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://vuldb.com/?id.258917	vdb-entry x_transferred
https://vuldb.com/?ctiid.258917	signature permissions-required x_transferred
https://vuldb.com/?submit.303530	third-party-advisory x_transferred
https://github.com/strik3r0x1/Vulns/blob/main/CSRF_Clavister-E80,E10.md	exploit x_transferred
https://docs.clavister.com/repo/cos-core-release-notes/doc/index.html#d0e2260	related x_transferred
https://my.clavister.com/downloads/?sid=1	patch x_transferred

2. CISA ADP Vulnrichment

Affected Products

Vendor

clavister

Product

e10

CPEs

cpe:2.3:a:clavister:e10:*:*:*:*:*:*:*:*

Default Status

unknown

Versions

Affected

14.00.0
14.00.1
14.00.2
14.00.3
14.00.4
14.00.5
14.00.6
14.00.7
14.00.8
14.00.9
14.00.10

Vendor

clavister

Product

e80

CPEs

cpe:2.3:a:clavister:e80:*:*:*:*:*:*:*:*

Default Status

unknown

Versions

Affected

14.00.0
14.00.1
14.00.2
14.00.3
14.00.4
14.00.5
14.00.6
14.00.7
14.00.8
14.00.9
14.00.10

Affected Products

Affected

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Affected

Affected

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References