{"id":"CVE-2024-1144","state":"PUBLISHED","title":"Improper Access Control at Alma Devklan Blog","description":"Improper access control vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow an unauthenticated user to access the application's functionalities without the need for credentials.","publishedAt":"2024-03-19T11:32:49.261Z","updatedAt":"2024-08-01T18:26:30.513Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","source":"INCIBE"},"assigner":"INCIBE","products":["Devklan Alma Blog"],"affected":[{"vendor":"Devklan","product":"Alma Blog","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.1.10","versionType":"custom"}]}],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alma-devklan-blog"],"weaknesses":["CWE-284"],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/1xxx/CVE-2024-1144.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-1144","state":"PUBLISHED","datePublished":"2024-03-19T11:32:49.261Z","dateUpdated":"2024-08-01T18:26:30.513Z","assignerShortName":"INCIBE","assignerOrgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateReserved":"2024-02-01T08:38:59.529Z"},"containers":{"cna":{"title":"Improper Access Control at Alma Devklan Blog","descriptions":[{"lang":"en","value":"Improper access control vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow an unauthenticated user to access the application's functionalities without the need for credentials."}],"affected":[{"vendor":"Devklan","product":"Alma Blog","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.1.10","versionType":"custom"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alma-devklan-blog"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","description":"CWE-284 Improper Access Control","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"INCIBE","orgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateUpdated":"2024-03-19T11:32:49.261Z"},"credits":[{"lang":"en","type":"finder","value":"David Utón Amaya"}],"datePublic":"2024-03-19T11:00:00.000Z","impacts":[{"capecId":"CAPEC-551","descriptions":[{"lang":"en","value":"CAPEC-551 Modify Existing Service"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Upgrade Alma Blog to version 2.2."}],"value":"Upgrade Alma Blog to version 2.2."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-1144","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-03-21T15:59:04.966952Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:59:24.803Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-alma-devklan-blog","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T18:26:30.513Z"}}]}}}