CVE-2024-2248
Last modified
CVE-2024-2248 is a medium-severity vulnerability rated 6.4/10 on the CVSS scale. A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 (SaaS) and 7.84.7 (Self-Hosted) may allow threat actors to take over the end user's account when clicking on a specially crafted URL sent to the victim’s user email.. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
A Header Injection vulnerability in the JFrog platform in versions below 7.85.0 (SaaS) and 7.84.7 (Self-Hosted) may allow threat actors to take over the end user's account when clicking on a specially crafted URL sent to the victim’s user email.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-2248?
How severe is CVE-2024-2248?
How do I fix CVE-2024-2248?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-2247JFrog Artifactory versions below 7.77.7, 7.82.1, are vulnera…6.1
- CVE-2024-22472 A buffer Overflow vulnerability in Silicon Labs 500 Series …8.1
- CVE-2024-22473TRNG is used before initialization by ECDSA signing driver w…7.5
- CVE-2024-22475Cross-site request forgery vulnerability in multiple printer…6.1
- CVE-2024-22476Improper input validation in some Intel(R) Neural Compressor…10
- CVE-2024-22477A cross-site scripting vulnerability exists in the admin con…4.3
- CVE-2024-2249The LA-Studio Element Kit for Elementor plugin for WordPress…5.4
- CVE-2024-22490Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 al…6.1
- CVE-2024-22491A Stored Cross Site Scripting (XSS) vulnerability in beetl-b…5.4
- CVE-2024-22492A stored XSS vulnerability exists in JFinalcms 5.0.0 via the…5.4
- CVE-2024-22493A stored XSS vulnerability exists in JFinalcms 5.0.0 via the…5.4
- CVE-2024-22494A stored XSS vulnerability exists in JFinalcms 5.0.0 via the…5.4
Are you affected by CVE-2024-2248?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST