What is the CVSS score of CVE-2024-27292?

CVE-2024-27292 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 69.5%.

Is there a public PoC exploit available for CVE-2024-27292?

Yes, a public proof-of-concept exploit is available for CVE-2024-27292. Prioritise patching immediately. EPSS: 69.5%.

Is there a patch available for CVE-2024-27292?

Yes, a patch is available for CVE-2024-27292. Update the affected software to the latest version immediately.

Docassemble CVE-2024-27292

HIGH

Use of Incorrectly-Resolved Name or Reference (CWE-706)

2024-03-21 security-advisories@github.com

Authentication Bypass Docassemble

7.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (github) · only source for this CVE.

CVSS VectorVendor: github

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Mar 21, 2024 - 02:52 cve.org

HIGH 7.5

DescriptionCVE.org

Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version 1.4.97 of the master branch.

AnalysisAI

Docassemble is an expert system for guided interviews and document assembly. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-706. Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version 1.4.97 of the master branch. Affected products include: Jhpyle Docassemble. Version information: version 1.4.97.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.