CVE-2024-13110
Last modified
CVE-2024-13110 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A vulnerability classified as problematic has been found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. Affected is an unknown function of the file src/main/java/com/yf/exam/modules/paper/controller/PaperController.java， of the component Exam Answer Handler. EPSS estimates a 0.59% chance of exploitation in the next 30 days.
Description
A vulnerability classified as problematic has been found in Beijing Yunfan Internet Technology Yunfan Learning Examination System 1.9.2. Affected is an unknown function of the file src/main/java/com/yf/exam/modules/paper/controller/PaperController.java， of the component Exam Answer Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Kaoshifeng | Yunfan Learning Examination System | 1.9.2 |
References
- https://github.com/qiutiandefeng/yfexam-exam/issues/5Exploit, Issue Tracking
- https://github.com/qiutiandefeng/yfexam-exam/issues/5#issue-2754675223Exploit, Issue Tracking
- https://vuldb.com/?ctiid.289926Permissions Required, VDB Entry
- https://vuldb.com/?id.289926Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.467700Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-13110?
How severe is CVE-2024-13110?
How do I fix CVE-2024-13110?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-13105A vulnerability has been found in D-Link DIR-816 A2 1.10CNB0…5.3
- CVE-2024-13106A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B…5.3
- CVE-2024-13107A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B…5.3
- CVE-2024-13108A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B…5.3
- CVE-2024-13109A vulnerability was found in Beijing Yunfan Internet Technol…6.9
- CVE-2024-1311The Brizy – Page Builder plugin for WordPress is vulnerable …8.8
- CVE-2024-13111A vulnerability classified as critical was found in Beijing …8.1
- CVE-2024-13112The WP MediaTagger WordPress plugin through 4.1.1 does not s…6.1
- CVE-2024-13113The Countdown Timer for Elementor WordPress plugin before 1.…5.9
- CVE-2024-13114The WP Projects Portfolio with Client Testimonials WordPress…6.1
- CVE-2024-13115The WP Projects Portfolio with Client Testimonials WordPress…6.1
- CVE-2024-13116The Crelly Slider WordPress plugin before 1.4.7 does not san…3.8
Are you affected by CVE-2024-13110?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST