Our news and updates

In WordPress versions up to and including 1.3.3.3 a critical severity vulnerability CVE-2024-8624 was detected. This vulnerability allows authenticated attackers with Contributor-level access and above to perform SQL Injection via the ‘meta_key’ attribute in the MDTF plugin for WordPress, potentially exposing sensitive database information. To fix this problem, users should upgrade to version 1.3.3.4. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-8624.

In Maven Archetype Plugin versions from 3.2.1 before 3.3.0 a medium severity vulnerability CVE-2024-47197 was detected. This vulnerability allows attackers to gain access to sensitive information, including user credentials, stored insecurely in the archetype-settings.xml file. To fix this issue, users must upgrade to version 3.3.0. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-47197.

In Authentik versions prior to 2024.8.3 and 2024.6.5 a medium severity vulnerability CVE-2024-47070 was detected. This vulnerability allows attackers to bypass the password login and access any account if they can provide an invalid IP address in the X-Forwarded-For header, but only if the system trusts that header. To fix this issue, users should upgrade Authentik to versions 2024.8.3 or 2024.6.5. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-47070.

In GitLab versions starting from 16.0 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 a medium severity vulnerability CVE-2024-4099 was detected. This vulnerability allows attackers to exploit an AI feature in GitLab to inject malicious content, potentially compromising the integrity of the system. To fix this issue, users should upgrade GitLab to versions 17.2.8, 17.3.4, or 17.4.1. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-4099.

In Grafana versions 8.5.0 up to 11.2.0 a medium severity vulnerability CVE-2024-8118 was detected. This vulnerability allows attackers with permission to write external alert instances to also write alert rules. To fix this issue, users must upgrade to versions 10.3.10, 10.4.9, 11.0.5, 11.1.6, or 11.2.1. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-8118.

In Mattermost versions 9.10.x <= 9.10.1, 9.9.x <= 9.9.2, and 9.5.x <= 9.5.8 a medium severity vulnerability CVE-2024-9155 was detected. This vulnerability allows attackers to view channel files that have not been linked to a post in channels they are a member of. Currently there is no patch version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-9155.

In GitLab Enterprise Edition versions starting from 16.5 and prior to 17.2.8, from 17.3 and prior to 17.3.4, and from 17.4 and prior to 17.4.1 a medium severity vulnerability CVE-2024-4278 was detected. This vulnerability allows a maintainer to obtain a Dependency Proxy password by editing specific settings. To address this issue, it is recommended to update to versions 17.2.8, 17.3.4, or 17.4.1 or higher. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-4278.

In Spring Framework versions 6.1.0 – 6.1.11, 6.0.0 – 6.0.22, 5.3.0 – 5.3.37 a medium severity vulnerability CVE-2024-38809 was detected in applications that parse ETags from “If-Match” or “If-None-Match” request headers. This vulnerability allows attackers to execute a Denial of Service attack. To fix this issue, upgrade to versions 6.1.x to 6.1.12, 6.0.x to 6.0.23, and 5.3.x to 5.3.38. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-38809.

In Mautic versions from 1.0.0-beta2 to 4.4.11 a critical severity vulnerability CVE-2021-27915 was detected. This vulnerability allows logged-in users with appropriate permissions to exploit XSS vulnerabilities in the description fields. This could result in elevated access to the system. To fix this issue, upgrade to version 4.4.12 or later. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-27915.