Vulnerability · Published Sep 1, 2024 · Assigned by VulDB

CVE-2024-8367HM Courts & Tribunals Service Probate Back Office Markdown NotificationService.java injection

Low 3.5

In plain English

A low-severity injection in Probate Back Office from HM Courts & Tribunals Service. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.5%top 59.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in HM Courts & Tribunals Service Probate Back Office up to c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31. It has been classified as problematic. Affected is an unknown function of the file src/main/java/uk/gov/hmcts/probate/service/NotificationService.java of the component Markdown Handler. The manipulation leads to injection. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as d90230d7cf575e5b0852d56660104c8bd2503c34. It is recommended to apply a patch to fix this issue.

Affected products (as reported)

Vendor	Product	Versions
HM Courts & Tribunals Service	Probate Back Office	c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31

Weakness: CWE-74 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

VDB-276270 | HM Courts & Tribunals Service Probate Back Office Markdown NotificationService.java injection vdb-entry
VDB-276270 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
https://tools.hmcts.net/jira/browse/DTSPB-4180 related
https://github.com/hmcts/probate-back-office/pull/2614 issue-tracking
https://github.com/hmcts/probate-back-office/commit/d90230d7cf575e5b0852d56660104c8bd2503c34 patch