CVE-2024-2821

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7. Affected by this issue is some unknown functionality of the file /src/dede/friendlink_edit.php. The manipulation of the argument id leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257708. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	DedeCMS	5.7
dedecms	dedecms	5.7

References

https://github.com/E1CHO/demo/blob/main/27.pdfExploit, Third Party Advisory
https://vuldb.com/?ctiid.257708Permissions Required, VDB Entry
https://vuldb.com/?id.257708Third Party Advisory, VDB Entry
https://github.com/E1CHO/demo/blob/main/27.pdfExploit, Third Party Advisory
https://vuldb.com/?ctiid.257708Permissions Required, VDB Entry
https://vuldb.com/?id.257708Third Party Advisory, VDB Entry

Timeline

Published: Mar 22, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-282119.8nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMI CVE-2024-282129.8nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization.CVE-2024-282139.8nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbi CVE-2024-282142.7nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker.CVE-2024-282157.5nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause o CVE-2024-282165.4nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access control, which could be the cause o CVE-2024-282195.9In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.CVE-2024-28224.3A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/vote_edit CVE-2024-282229.8In Veritas NetBackup before 8.1.2 and NetBackup Appliance before 3.1.2, the BPCD process inadequately validates the file path, allowing an u CVE-2024-282246.6Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauth CVE-2024-282267.5in OpenHarmony v4.0.0 and prior versions allow a remote attacker cause DOS through improper input.CVE-2024-282285.3In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possible