CVE-2024-33999

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The referrer URL used by MFA required additional sanitizing, rather than being used directly.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
May 31, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-340010.0A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software CVE-2024-340004.3ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk.CVE-2024-340018.4Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk.CVE-2024-340026.5In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restoCVE-2024-340035.9In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restoCVE-2024-340046.5In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restoCVE-2024-340056.5In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restoCVE-2024-340064.3The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead oCVE-2024-340078.8The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.CVE-2024-340088.8Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk.CVE-2024-340097.5Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages wCVE-2024-340108.2Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent
CVE-2024-33999: Critical severity, CVSS 9.8 | Vulnix