{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-8367", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2024-08-31T11:28:20.704Z", "datePublished": "2024-09-01T04:00:05.840Z", "dateUpdated": "2024-09-03T14:06:34.449Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2024-09-01T04:00:05.840Z"}, "title": "HM Courts & Tribunals Service Probate Back Office Markdown NotificationService.java injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "CWE-74 Injection"}]}], "affected": [{"vendor": "HM Courts & Tribunals Service", "product": "Probate Back Office", "versions": [{"version": "c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31", "status": "affected"}], "modules": ["Markdown Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in HM Courts & Tribunals Service Probate Back Office up to c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31. It has been classified as problematic. Affected is an unknown function of the file src/main/java/uk/gov/hmcts/probate/service/NotificationService.java of the component Markdown Handler. The manipulation leads to injection. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as d90230d7cf575e5b0852d56660104c8bd2503c34. It is recommended to apply a patch to fix this issue."}, {"lang": "de", "value": "Es wurde eine problematische Schwachstelle in HM Courts & Tribunals Service Probate Back Office bis c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31 ausgemacht. Es betrifft eine unbekannte Funktion der Datei src/main/java/uk/gov/hmcts/probate/service/NotificationService.java der Komponente Markdown Handler. Mittels dem Manipulieren mit unbekannten Daten kann eine injection-Schwachstelle ausgenutzt werden. Dieses Produkt verzichtet auf eine Versionierung und verwendet stattdessen Rolling Releases. Deshalb sind keine Details zu betroffenen oder zu aktualisierende Versionen vorhanden. Der Patch wird als d90230d7cf575e5b0852d56660104c8bd2503c34 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.7, "vectorString": "AV:A/AC:L/Au:S/C:N/I:P/A:N"}}], "timeline": [{"time": "2024-08-31T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2024-08-31T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2024-08-31T13:33:46.000Z", "lang": "en", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.276270", "name": "VDB-276270 | HM Courts & Tribunals Service Probate Back Office Markdown NotificationService.java injection", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.276270", "name": "VDB-276270 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://tools.hmcts.net/jira/browse/DTSPB-4180", "tags": ["related"]}, {"url": "https://github.com/hmcts/probate-back-office/pull/2614", "tags": ["issue-tracking"]}, {"url": "https://github.com/hmcts/probate-back-office/commit/d90230d7cf575e5b0852d56660104c8bd2503c34", "tags": ["patch"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-03T14:01:03.874161Z", "id": "CVE-2024-8367", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-03T14:06:34.449Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-8367", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-03T14:01:03.874161Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-03T14:01:08.844Z"}}], "cna": {"title": "HM Courts & Tribunals Service Probate Back Office Markdown NotificationService.java injection", "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.7, "vectorString": "AV:A/AC:L/Au:S/C:N/I:P/A:N"}}], "affected": [{"vendor": "HM Courts & Tribunals Service", "modules": ["Markdown Handler"], "product": "Probate Back Office", "versions": [{"status": "affected", "version": "c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31"}]}], "timeline": [{"lang": "en", "time": "2024-08-31T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2024-08-31T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2024-08-31T13:33:46.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.276270", "name": "VDB-276270 | HM Courts & Tribunals Service Probate Back Office Markdown NotificationService.java injection", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.276270", "name": "VDB-276270 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://tools.hmcts.net/jira/browse/DTSPB-4180", "tags": ["related"]}, {"url": "https://github.com/hmcts/probate-back-office/pull/2614", "tags": ["issue-tracking"]}, {"url": "https://github.com/hmcts/probate-back-office/commit/d90230d7cf575e5b0852d56660104c8bd2503c34", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in HM Courts & Tribunals Service Probate Back Office up to c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31. It has been classified as problematic. Affected is an unknown function of the file src/main/java/uk/gov/hmcts/probate/service/NotificationService.java of the component Markdown Handler. The manipulation leads to injection. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as d90230d7cf575e5b0852d56660104c8bd2503c34. It is recommended to apply a patch to fix this issue."}, {"lang": "de", "value": "Es wurde eine problematische Schwachstelle in HM Courts & Tribunals Service Probate Back Office bis c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31 ausgemacht. Es betrifft eine unbekannte Funktion der Datei src/main/java/uk/gov/hmcts/probate/service/NotificationService.java der Komponente Markdown Handler. Mittels dem Manipulieren mit unbekannten Daten kann eine injection-Schwachstelle ausgenutzt werden. Dieses Produkt verzichtet auf eine Versionierung und verwendet stattdessen Rolling Releases. Deshalb sind keine Details zu betroffenen oder zu aktualisierende Versionen vorhanden. Der Patch wird als d90230d7cf575e5b0852d56660104c8bd2503c34 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "CWE-74 Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2024-09-01T04:00:05.840Z"}}}, "cveMetadata": {"cveId": "CVE-2024-8367", "state": "PUBLISHED", "dateUpdated": "2024-09-03T14:06:34.449Z", "dateReserved": "2024-08-31T11:28:20.704Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2024-09-01T04:00:05.840Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in HM Courts & Tribunals Service Probate Back Office up to c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31. It has been classified as problematic. Affected is an unknown function of the file src/main/java/uk/gov/hmcts/probate/service/NotificationService.java of the component Markdown Handler. The manipulation leads to injection. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as d90230d7cf575e5b0852d56660104c8bd2503c34. It is recommended to apply a patch to fix this issue."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en HM Courts & Tribunals Service Probate Back Office hasta c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31. Se ha clasificado como problem\u00e1tica. Se ve afectada una funci\u00f3n desconocida del archivo src/main/java/uk/gov/hmcts/probate/service/NotificationService.java del componente Markdown Handler. La manipulaci\u00f3n conduce a una inyecci\u00f3n. Este producto utiliza la entrega continua con versiones sucesivas. Por lo tanto, no hay disponibles detalles de las versiones afectadas ni de las versiones actualizadas. El parche se identifica como d90230d7cf575e5b0852d56660104c8bd2503c34. Se recomienda aplicar un parche para solucionar este problema."}], "id": "CVE-2024-8367", "lastModified": "2024-09-03T12:59:02.453", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 2.7, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:A/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 5.1, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "automatable": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "recovery": "NOT_DEFINED", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "subsequentSystemIntegrity": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnerabilityResponseEffort": "NOT_DEFINED", "vulnerableSystemAvailability": "NONE", "vulnerableSystemConfidentiality": "NONE", "vulnerableSystemIntegrity": "LOW"}, "source": "cna@vuldb.com", "type": "Secondary"}]}, "published": "2024-09-01T04:15:14.107", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/hmcts/probate-back-office/commit/d90230d7cf575e5b0852d56660104c8bd2503c34"}, {"source": "cna@vuldb.com", "url": "https://github.com/hmcts/probate-back-office/pull/2614"}, {"source": "cna@vuldb.com", "url": "https://tools.hmcts.net/jira/browse/DTSPB-4180"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.276270"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.276270"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "cna@vuldb.com", "type": "Primary"}]}

{}