CVE-2024-28251mediumCWE-345

CVE-2024-28251: falha de média gravidade em pinterest querybook

Cross-site websocket hijacking in Querybook

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar querybook

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.6epss 0.2%
Querybook is a Big Data Querying UI, combining collocated table metadata and a simple notebook interface. Querybook's datadocs functionality works by using a Websocket Server. The client talks to this WSS whenever updating/deleting/reading any cells as well as for watching the live status of query executions. Currently the CORS setting allows all origins, which could result in cross-site websocket hijacking and allow attackers to read/edit/remove datadocs of the user. This issue has been addressed in version 3.32.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
pinterest · querybook
CVEs relacionadas — pinterest querybook

No mesmo produto, das mais perigosas para as menos.

CVE-2024-26148MEDIUMQuerybook's Stored Cross-Site Scripting vulnerability allows Privilege ElevationEPSS 0.5%CVE-2022-46151MEDIUMReflected XSSEPSS 0.4%CVE-2024-27103MEDIUMQuerybook Stored Cross-Site Scripting allows Privilege ElevationEPSS 0.4%