{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-0647", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2024-01-17T13:36:53.451Z", "datePublished": "2024-01-17T18:31:04.100Z", "dateUpdated": "2024-10-21T11:51:13.090Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2024-01-22T05:48:07.353Z"}, "title": "Sparksuite SimpleMDE iFrame cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Cross Site Scripting"}]}], "affected": [{"vendor": "Sparksuite", "product": "SimpleMDE", "versions": [{"version": "1.11.0", "status": "affected"}, {"version": "1.11.1", "status": "affected"}, {"version": "1.11.2", "status": "affected"}], "modules": ["iFrame Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as problematic, was found in Sparksuite SimpleMDE up to 1.11.2. This affects an unknown part of the component iFrame Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-251373 was assigned to this vulnerability."}, {"lang": "de", "value": "Es wurde eine problematische Schwachstelle in Sparksuite SimpleMDE bis 1.11.2 gefunden. Dabei betrifft es einen unbekannter Codeteil der Komponente iFrame Handler. Dank Manipulation mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}], "timeline": [{"time": "2024-01-17T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2024-01-17T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2024-01-22T06:52:36.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Gab3 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "Gab3 (VulDB User)", "type": "analyst"}], "references": [{"url": "https://vuldb.com/?id.251373", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.251373", "tags": ["signature", "permissions-required"]}, {"url": "https://www.youtube.com/watch?v=KtDjoJlrpAc", "tags": ["media-coverage"]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:11:35.637Z"}, "title": "CVE Program Container", "references": [{"url": "https://vuldb.com/?id.251373", "tags": ["vdb-entry", "x_transferred"]}, {"url": "https://vuldb.com/?ctiid.251373", "tags": ["signature", "permissions-required", "x_transferred"]}, {"url": "https://www.youtube.com/watch?v=KtDjoJlrpAc", "tags": ["media-coverage", "x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-01-18T18:14:20.596334Z", "id": "CVE-2024-0647", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T11:51:13.090Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://vuldb.com/?id.251373", "tags": ["vdb-entry", "x_transferred"]}, {"url": "https://vuldb.com/?ctiid.251373", "tags": ["signature", "permissions-required", "x_transferred"]}, {"url": "https://www.youtube.com/watch?v=KtDjoJlrpAc", "tags": ["media-coverage", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:11:35.637Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-0647", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-01-18T18:14:20.596334Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T11:51:09.325Z"}}], "cna": {"title": "Sparksuite SimpleMDE iFrame cross site scripting", "credits": [{"lang": "en", "type": "reporter", "value": "Gab3 (VulDB User)"}, {"lang": "en", "type": "analyst", "value": "Gab3 (VulDB User)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}], "affected": [{"vendor": "Sparksuite", "modules": ["iFrame Handler"], "product": "SimpleMDE", "versions": [{"status": "affected", "version": "1.11.0"}, {"status": "affected", "version": "1.11.1"}, {"status": "affected", "version": "1.11.2"}]}], "timeline": [{"lang": "en", "time": "2024-01-17T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2024-01-17T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2024-01-22T06:52:36.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.251373", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.251373", "tags": ["signature", "permissions-required"]}, {"url": "https://www.youtube.com/watch?v=KtDjoJlrpAc", "tags": ["media-coverage"]}], "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as problematic, was found in Sparksuite SimpleMDE up to 1.11.2. This affects an unknown part of the component iFrame Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-251373 was assigned to this vulnerability."}, {"lang": "de", "value": "Es wurde eine problematische Schwachstelle in Sparksuite SimpleMDE bis 1.11.2 gefunden. Dabei betrifft es einen unbekannter Codeteil der Komponente iFrame Handler. Dank Manipulation mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Cross Site Scripting"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2024-01-22T05:48:07.353Z"}}}, "cveMetadata": {"cveId": "CVE-2024-0647", "state": "PUBLISHED", "dateUpdated": "2024-10-21T11:51:13.090Z", "dateReserved": "2024-01-17T13:36:53.451Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2024-01-17T18:31:04.100Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sparksuite:simplemde:*:*:*:*:*:*:*:*", "matchCriteriaId": "FAC48EE7-035E-4516-B0EA-8EA1475752C0", "versionEndIncluding": "1.11.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability, which was classified as problematic, was found in Sparksuite SimpleMDE up to 1.11.2. This affects an unknown part of the component iFrame Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-251373 was assigned to this vulnerability."}, {"lang": "es", "value": "Una vulnerabilidad clasificada como problem\u00e1tica fue encontrada en Sparksuite SimpleMDE hasta 1.11.2. Una parte desconocida del componente iFrame Handler afecta a una parte desconocida. La manipulaci\u00f3n conduce a cross site scripting. Es posible iniciar el ataque de forma remota. La explotaci\u00f3n ha sido divulgada al p\u00fablico y puede utilizarse. A esta vulnerabilidad se le asign\u00f3 el identificador VDB-251373."}], "id": "CVE-2024-0647", "lastModified": "2024-11-21T08:47:03.907", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-01-17T19:15:08.480", "references": [{"source": "cna@vuldb.com", "tags": ["Permissions Required", "Third Party Advisory"], "url": "https://vuldb.com/?ctiid.251373"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory"], "url": "https://vuldb.com/?id.251373"}, {"source": "cna@vuldb.com", "tags": ["Exploit"], "url": "https://www.youtube.com/watch?v=KtDjoJlrpAc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required", "Third Party Advisory"], "url": "https://vuldb.com/?ctiid.251373"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://vuldb.com/?id.251373"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "https://www.youtube.com/watch?v=KtDjoJlrpAc"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}