nvd-json-data-feeds/CVE-2024/CVE-2024-281xx/CVE-2024-28196.json

{
  "id": "CVE-2024-28196",
  "sourceIdentifier": "security-advisories@github.com",
  "published": "2024-03-13T18:15:07.620",
  "lastModified": "2025-02-12T15:18:34.053",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version < 1.9.0 does not prevent other pages from displaying it in an iframe and is thus vulnerable to clickjacking. Clickjacking can be used to trick an existing user of YourSpotify to trigger actions, such as allowing signup of other users or deleting the current user account. Clickjacking works by opening the target application in an invisible iframe on an attacker-controlled site and luring a victim to visit the attacker page and interacting with it. By positioning elements over the invisible iframe, a victim can be tricked into triggering malicious or destructive actions in the invisible iframe, while they think they interact with a totally different site altogether. When a victim visits an attacker-controlled site while they are logged into YourSpotify, they can be tricked into performing actions on their YourSpotify instance without their knowledge. These actions include allowing signup of other users or deleting the current user account, resulting in a high impact to the integrity of YourSpotify. This issue has been addressed in version 1.9.0. Users are advised to upgrade. There are no known workarounds for this vulnerability."
    },
    {
      "lang": "es",
      "value": "your_spotify es un panel de seguimiento de Spotify autohospedado y de c\u00f3digo abierto. La versi\u00f3n de YourSpotify &lt; 1.9.0 no impide que otras p\u00e1ginas la muestren en un iframe y, por lo tanto, es vulnerable al clickjacking. El clickjacking se puede utilizar para enga\u00f1ar a un usuario existente de YourSpotify para que active acciones, como permitir el registro de otros usuarios o eliminar la cuenta de usuario actual. El clickjacking funciona abriendo la aplicaci\u00f3n objetivo en un iframe invisible en un sitio controlado por un atacante y atrayendo a la v\u00edctima para que visite la p\u00e1gina del atacante e interact\u00fae con ella. Al colocar elementos sobre el iframe invisible, se puede enga\u00f1ar a una v\u00edctima para que desencadene acciones maliciosas o destructivas en el iframe invisible, mientras piensa que interact\u00faa con un sitio totalmente diferente. Cuando una v\u00edctima visita un sitio controlado por un atacante mientras est\u00e1 iniciada en YourSpotify, se la puede enga\u00f1ar para que realice acciones en su instancia de YourSpotify sin su conocimiento. Estas acciones incluyen permitir el registro de otros usuarios o eliminar la cuenta de usuario actual, lo que tiene un alto impacto en la integridad de YourSpotify. Este problema se solucion\u00f3 en la versi\u00f3n 1.9.0. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "security-advisories@github.com",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      },
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ]
  },
  "weaknesses": [
    {
      "source": "security-advisories@github.com",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1021"
        }
      ]
    },
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1021"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:yooooomi:your_spotify:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.9.0",
              "matchCriteriaId": "D4D16B98-81FE-426E-BD95-42B155B9C613"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-m5x2-6hjm-cggq",
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-m5x2-6hjm-cggq",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}