Vulnerability Details CVE-2024-24562
vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addressed in commit `68dfa6614` which is expected to be included in future releases. Users are advised to upgrade when a new release is made. While an upgrade path is not available users may modify the docker image build to insert the headers into nginx.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 32.0%
CVSS Severity
CVSS v3 Score 5.4
References
- https://github.com/vantage6/vantage6-UI/commit/68dfa661415182da0e5717bd58db3d00aedcbd2e
- https://github.com/vantage6/vantage6-UI/security/advisories/GHSA-gwq3-pvwq-4c9w
- https://github.com/vantage6/vantage6-UI/commit/68dfa661415182da0e5717bd58db3d00aedcbd2e
- https://github.com/vantage6/vantage6-UI/security/advisories/GHSA-gwq3-pvwq-4c9w
Products affected by CVE-2024-24562
-
cpe:2.3:a:vantage6:vantage6-ui:-
-
cpe:2.3:a:vantage6:vantage6-ui:3.3.6
-
cpe:2.3:a:vantage6:vantage6-ui:3.3.7
-
cpe:2.3:a:vantage6:vantage6-ui:3.4.0
-
cpe:2.3:a:vantage6:vantage6-ui:3.5.0
-
cpe:2.3:a:vantage6:vantage6-ui:3.5.1
-
cpe:2.3:a:vantage6:vantage6-ui:3.5.2
-
cpe:2.3:a:vantage6:vantage6-ui:3.5.3
-
cpe:2.3:a:vantage6:vantage6-ui:3.6.0
-
cpe:2.3:a:vantage6:vantage6-ui:3.6.1
-
cpe:2.3:a:vantage6:vantage6-ui:3.7.0
-
cpe:2.3:a:vantage6:vantage6-ui:3.7.1
-
cpe:2.3:a:vantage6:vantage6-ui:3.8.0
-
cpe:2.3:a:vantage6:vantage6-ui:4.0.0
-
cpe:2.3:a:vantage6:vantage6-ui:4.0.1
-
cpe:2.3:a:vantage6:vantage6-ui:4.0.2
-
cpe:2.3:a:vantage6:vantage6-ui:4.0.3
-
cpe:2.3:a:vantage6:vantage6-ui:4.0.4
-
cpe:2.3:a:vantage6:vantage6-ui:4.1.0
-
cpe:2.3:a:vantage6:vantage6-ui:4.2.0