nvd-json-data-feeds/CVE-2024/CVE-2024-256xx/CVE-2024-25633.json

{
  "id": "CVE-2024-25633",
  "sourceIdentifier": "security-advisories@github.com",
  "published": "2024-08-15T19:15:18.213",
  "lastModified": "2024-08-15T19:15:18.213",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "eLabFTW is an open source electronic lab notebook for research labs.  In an eLabFTW system, one might disallow user creation except for by system administrators, administrators and trusted services. If administrators are allowed to create new users (which is the default), the vulnerability allows any user to create new users in teams where they are members. The new users are automatically validated and administrators are not notified. This can allow a user with permanent or temporary access to a user account or API key to maintain persistence in an eLabFTW system. Additionally, it allows the user to create separate account under a different name, and produce misleading revision histories. No additional privileges are granted to the new user. Users should upgrade to version 5.0.0 to receive a patch. As a workaround, disabling both options that allow *administrators* to create users will provide a mitigation."
    },
    {
      "lang": "es",
      "value": "eLabFTW es un cuaderno de laboratorio electr\u00f3nico de c\u00f3digo abierto para laboratorios de investigaci\u00f3n. En un sistema eLabFTW, se podr\u00eda no permitir la creaci\u00f3n de usuarios excepto por parte de administradores del sistema, administradores y servicios confiables. Si a los administradores se les permite crear nuevos usuarios (que es la opci\u00f3n predeterminada), la vulnerabilidad permite a cualquier usuario crear nuevos usuarios en equipos de los que son miembros. Los nuevos usuarios se validan autom\u00e1ticamente y no se notifica a los administradores. Esto puede permitir que un usuario con acceso permanente o temporal a una cuenta de usuario o clave API mantenga la persistencia en un sistema eLabFTW. Adem\u00e1s, permite al usuario crear una cuenta separada con un nombre diferente y generar historiales de revisiones enga\u00f1osos. No se otorgan privilegios adicionales al nuevo usuario. Los usuarios deben actualizar a la versi\u00f3n 5.0.0 para recibir un parche. Como soluci\u00f3n alternativa, deshabilitar ambas opciones que permiten a los *administradores* crear usuarios proporcionar\u00e1 una mitigaci\u00f3n."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "security-advisories@github.com",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ]
  },
  "weaknesses": [
    {
      "source": "security-advisories@github.com",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-266"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/elabftw/elabftw/security/advisories/GHSA-v677-8x8p-636v",
      "source": "security-advisories@github.com"
    }
  ]
}