CVE-2024-39326mediumCWE-352

CVE-2024-39326: falha de média gravidade em NationalSecurityAgency skills-service

SkillTree CSRF Vulnerability allows an attacker to modify the Video and Captions of a Skill

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar skills-service

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.4epss 0.3%
SkillTree is a micro-learning gamification platform. Prior to version 2.12.6, the endpoint `/admin/projects/{projectname}/skills/{skillname}/video` (and probably others) is open to a cross-site request forgery (CSRF) vulnerability. Due to the endpoint being CSRFable e.g POST request, supports a content type that can be exploited (multipart file upload), makes a state change and has no CSRF mitigations in place (samesite flag, CSRF token). It is possible to perform a CSRF attack against a logged in admin account, allowing an attacker that can target a logged in admin of Skills Service to modify the videos, captions, and text of the skill. Version 2.12.6 contains a patch for this issue.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
NationalSecurityAgency · skills-service
CVEs relacionadas — NationalSecurityAgency skills-service

No mesmo produto, das mais perigosas para as menos.

CVE-2026-54694CRITICALNationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account TakeoverEPSS 0.5%