Vulnerability · Published Mar 14, 2024 · Assigned by GitHub_M

CVE-2024-24562Security headers not set in vantage6-UI

Medium 5.4

In plain English

A medium-severity security flaw in vantage6-UI from vantage6. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 71.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addressed in commit `68dfa6614` which is expected to be included in future releases. Users are advised to upgrade when a new release is made. While an upgrade path is not available users may modify the docker image build to insert the headers into nginx.

Affected products (as reported)

Vendor	Product	Versions
vantage6	vantage6-UI	<= 4.2.0

Weakness: CWE-693, CWE-668 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

https://github.com/vantage6/vantage6-UI/security/advisories/GHSA-gwq3-pvwq-4c9w x_refsource_CONFIRM
https://github.com/vantage6/vantage6-UI/commit/68dfa661415182da0e5717bd58db3d00aedcbd2e x_refsource_MISC