{"id":"CVE-2024-11486","state":"PUBLISHED","title":"Code4Berry Decoration Management System User Permission user_permission.php","description":"A vulnerability, which was classified as problematic, was found in Code4Berry Decoration Management System 1.0. This affects an unknown part of the file /decoration/admin/user_permission.php of the component User Permission Handler. The manipulation leads to permission issues. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2024-11-20T16:00:11.888Z","updatedAt":"2024-12-02T18:52:49.375Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["Code4Berry Decoration Management System"],"affected":[{"vendor":"Code4Berry","product":"Decoration Management System","versions":[{"version":"1.0","status":"affected"}],"modules":["User Permission Handler"]}],"references":["https://vuldb.com/?id.285501","https://vuldb.com/?ctiid.285501","https://vuldb.com/?submit.441916"],"weaknesses":["CWE-275","CWE-266"],"ingestedAt":"2026-10-29T20:06:50.777Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/11xxx/CVE-2024-11486.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-11486","state":"PUBLISHED","datePublished":"2024-11-20T16:00:11.888Z","dateUpdated":"2024-12-02T18:52:49.375Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2024-11-20T08:11:07.787Z"},"containers":{"cna":{"title":"Code4Berry Decoration Management System User Permission user_permission.php","descriptions":[{"lang":"en","value":"A vulnerability, which was classified as problematic, was found in Code4Berry Decoration Management System 1.0. This affects an unknown part of the file /decoration/admin/user_permission.php of the component User Permission Handler. The manipulation leads to permission issues. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."},{"lang":"de","value":"Es wurde eine problematische Schwachstelle in Code4Berry Decoration Management System 1.0 gefunden. Hiervon betroffen ist ein unbekannter Codeblock der Datei /decoration/admin/user_permission.php der Komponente User Permission Handler. Durch das Manipulieren mit unbekannten Daten kann eine permission issues-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"Code4Berry","product":"Decoration Management System","versions":[{"version":"1.0","status":"affected"}],"modules":["User Permission Handler"]}],"references":[{"url":"https://vuldb.com/?id.285501","name":"VDB-285501 | Code4Berry Decoration Management System User Permission user_permission.php","tags":["vdb-entry"]},{"url":"https://vuldb.com/?ctiid.285501","name":"VDB-285501 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.441916","name":"Submit #441916 | Code4Berry Decoration Management System 1.0 Improper Handling of Insufficient Permissions or Privileges","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-275","type":"CWE","lang":"en","description":"Permission Issues"}]},{"descriptions":[{"cweId":"CWE-266","type":"CWE","lang":"en","description":"Incorrect Privilege Assignment"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2024-11-20T16:00:11.888Z"},"timeline":[{"time":"2024-11-20T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2024-11-20T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2024-11-20T09:16:19.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"scumdestroy (VulDB User)","type":"reporter"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-12-02T18:52:30.831860Z","id":"CVE-2024-11486","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-12-02T18:52:49.375Z"}}]}}}