CVE-2024-1145 - Vulnerability Details - OpenCVE

Description

User enumeration vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow a remote user to retrieve all valid users registered in the application just by looking at the request response.

Published: 2024-03-19

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Devklan

Alma Blog

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.1.10

Configuration 1 [-]

cpe:2.3:a:alma:alma_blog:*:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

Vendor Solution

Upgrade Alma Blog to version 2.2.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2024-16914	User enumeration vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow a remote user to retrieve all valid users registered in the application just by looking at the request response.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00077.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alma-devklan-blog

History

Wed, 15 Oct 2025 18:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Alma Alma alma Blog
CPEs		cpe:2.3:a:alma:alma_blog::::::::
Vendors & Products		Alma Alma alma Blog

Subscriptions

Alma Alma Blog

Devklan Alma Blog

MITRE

Status: PUBLISHED

Assigner: INCIBE

Published: 2024-03-19T11:35:46.187Z

Updated: 2024-08-02T15:12:00.863Z

Reserved: 2024-02-01T08:39:00.508Z

Link: CVE-2024-1145

Vulnrichment

Updated: 2024-08-02T15:11:54.665Z

NVD

Status : Analyzed

Published: 2024-03-19T12:15:08.177

Modified: 2025-10-15T18:04:19.183

Link: CVE-2024-1145

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-204

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-1145", "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "state": "PUBLISHED", "assignerShortName": "INCIBE", "dateReserved": "2024-02-01T08:39:00.508Z", "datePublished": "2024-03-19T11:35:46.187Z", "dateUpdated": "2024-08-02T15:12:00.863Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Alma Blog", "vendor": "Devklan", "versions": [{"lessThanOrEqual": "2.1.10", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "David Ut\u00f3n Amaya"}], "datePublic": "2024-03-19T11:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "User enumeration vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow a remote user to retrieve all valid users registered in the application just by looking at the request response."}], "value": "User enumeration vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow a remote user to retrieve all valid users registered in the application just by looking at the request response."}], "impacts": [{"capecId": "CAPEC-541", "descriptions": [{"lang": "en", "value": "CAPEC-541 Application Fingerprinting"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-204", "description": "CWE-204: Observable Response Discrepancy", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "shortName": "INCIBE", "dateUpdated": "2024-03-19T11:35:46.187Z"}, "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alma-devklan-blog"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upgrade Alma Blog to version 2.2."}], "value": "Upgrade Alma Blog to version 2.2."}], "source": {"discovery": "EXTERNAL"}, "title": "Observable Response Discrepancy at Alma Devklan Blog", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:26:30.624Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alma-devklan-blog", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "devklan", "product": "alma_blog", "cpes": ["cpe:2.3:a:devklan:alma_blog:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.1.10", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-02T15:10:26.640851Z", "id": "CVE-2024-1145", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-02T15:12:00.863Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-1145", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-02T15:10:26.640851Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:devklan:alma_blog:*:*:*:*:*:*:*:*"], "vendor": "devklan", "product": "alma_blog", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.1.10"}], "defaultStatus": "unaffected"}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2024-08-02T15:11:54.665Z"}}], "cna": {"title": "Observable Response Discrepancy at Alma Devklan Blog", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "David Ut\u00f3n Amaya"}], "impacts": [{"capecId": "CAPEC-541", "descriptions": [{"lang": "en", "value": "CAPEC-541 Application Fingerprinting"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Devklan", "product": "Alma Blog", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.1.10"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade Alma Blog to version 2.2.", "supportingMedia": [{"type": "text/html", "value": "Upgrade Alma Blog to version 2.2.", "base64": false}]}], "datePublic": "2024-03-19T11:00:00.000Z", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alma-devklan-blog"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "User enumeration vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow a remote user to retrieve all valid users registered in the application just by looking at the request response.", "supportingMedia": [{"type": "text/html", "value": "User enumeration vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow a remote user to retrieve all valid users registered in the application just by looking at the request response.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-204", "description": "CWE-204: Observable Response Discrepancy"}]}], "providerMetadata": {"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "shortName": "INCIBE", "dateUpdated": "2024-03-19T11:35:46.187Z"}}}, "cveMetadata": {"cveId": "CVE-2024-1145", "state": "PUBLISHED", "dateUpdated": "2024-08-01T18:26:30.624Z", "dateReserved": "2024-02-01T08:39:00.508Z", "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "datePublished": "2024-03-19T11:35:46.187Z", "assignerShortName": "INCIBE"}, "dataVersion": "5.1"}