CVE-2024-28251

Katalog CVE

CVSS 7.3 · High EPSS 0,24%

Kerentanan Insufficient Verification of Data Authenticity pada pinterest querybook. Skor CVSS 3.1 7.3 (High) menurut NVD.

Deskripsi (NVD)

Querybook is a Big Data Querying UI, combining collocated table metadata and a simple notebook interface. Querybook's datadocs functionality works by using a Websocket Server. The client talks to this WSS whenever updating/deleting/reading any cells as well as for watching the live status of query executions. Currently the CORS setting allows all origins, which could result in cross-site websocket hijacking and allow attackers to read/edit/remove datadocs of the user. This issue has been addressed in version 3.32.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD

14 Maret 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.3 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 13,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pinterest/querybook/security/advisories/GHSA-5349-j4c9-x767 advisory vendor
• https://github.com/pinterest/querybook/pull/1425 patch