github - ghsa-7wpf-4jwj-r2v3

ghsa-7wpf-4jwj-r2v3

Vulnerability from github

Published

2025-01-02 18:30

Modified

2025-01-02 18:30

Severity ?

5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Details

While assignment of a user to a team (bracket) in CTFd should be possible only once, at the registration, a flaw in logic implementation allows an authenticated user to reset it's bracket and then pick a new one, joining another team while a competition is already ongoing. This issue impacts releases from 3.7.0 up to 3.7.4 and was addressed by pull request 2636 https://github.com/CTFd/CTFd/pull/2636 included in 3.7.5 release.

Show details on source website

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-11716"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-837"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-02T17:15:07Z",
    "severity": "MODERATE"
  },
  "details": "While assignment of a user to a team (bracket) in\u00a0CTFd  should be possible only once, at the registration, a flaw in logic implementation allows an authenticated user to reset it\u0027s bracket and then pick a new one, joining another team while a competition is already ongoing.\nThis issue impacts releases from 3.7.0 up to 3.7.4 and was addressed by  pull request 2636 https://github.com/CTFd/CTFd/pull/2636 \u00a0included in 3.7.5 release.",
  "id": "GHSA-7wpf-4jwj-r2v3",
  "modified": "2025-01-02T18:30:36Z",
  "published": "2025-01-02T18:30:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11716"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CTFd/CTFd/pull/2636"
    },
    {
      "type": "WEB",
      "url": "https://blog.ctfd.io/ctfd-3-7-5"
    },
    {
      "type": "WEB",
      "url": "https://cert.pl/en/posts/2025/01/CVE-2024-11716"
    },
    {
      "type": "WEB",
      "url": "https://ctfd.io"
    },
    {
      "type": "WEB",
      "url": "https://seclists.org/fulldisclosure/2024/Dec/21"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2024-11716 (GCVE-0-2024-11716)

Vulnerability from cvelistv5

Published

2025-01-02 16:07

Modified

2025-01-02 17:34

Severity ?

5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CWE

CWE-837 - Improper Enforcement of a Single, Unique Action

Summary

While assignment of a user to a team (bracket) in CTFd should be possible only once, at the registration, a flaw in logic implementation allows an authenticated user to reset it's bracket and then pick a new one, joining another team while a competition is already ongoing. This issue impacts releases from 3.7.0 up to 3.7.4 and was addressed by pull request 2636 https://github.com/CTFd/CTFd/pull/2636 included in 3.7.5 release.

References

►

URL

Tags

	https://github.com/CTFd/CTFd/pull/2636	patch
	https://cert.pl/en/posts/2025/01/CVE-2024-11716	third-party-advisory
	https://ctfd.io/	product
	https://blog.ctfd.io/ctfd-3-7-5/	vendor-advisory
	https://seclists.org/fulldisclosure/2024/Dec/21	mailing-list, exploit

Impacted products

	Vendor	Product	Version
	CTFd	CTFd	Version: 3.7.0

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11716",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-02T17:34:30.679929Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-02T17:34:54.872Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://seclists.org/fulldisclosure/2024/Dec/21"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CTFd",
          "repo": "https://github.com/CTFd/CTFd",
          "vendor": "CTFd",
          "versions": [
            {
              "lessThanOrEqual": "3.7.4",
              "status": "affected",
              "version": "3.7.0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "B\u0142a\u017cej Adamczyk (efigo.pl)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "While assignment of a user to a team (bracket) in\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCTFd \u003c/span\u003e should be possible only once, at the registration, a flaw in logic implementation allows an authenticated user to reset it\u0027s bracket and then pick a new one, joining another team while a competition is already ongoing.\u003cbr\u003eThis issue impacts releases from 3.7.0 up to 3.7.4 and was addressed by \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/CTFd/CTFd/pull/2636\"\u003epull request 2636\u003c/a\u003e\u0026nbsp;included in 3.7.5 release."
            }
          ],
          "value": "While assignment of a user to a team (bracket) in\u00a0CTFd  should be possible only once, at the registration, a flaw in logic implementation allows an authenticated user to reset it\u0027s bracket and then pick a new one, joining another team while a competition is already ongoing.\nThis issue impacts releases from 3.7.0 up to 3.7.4 and was addressed by  pull request 2636 https://github.com/CTFd/CTFd/pull/2636 \u00a0included in 3.7.5 release."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-837",
              "description": "CWE-837 Improper Enforcement of a Single, Unique Action",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-02T16:07:46.868Z",
        "orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
        "shortName": "CERT-PL"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/CTFd/CTFd/pull/2636"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://cert.pl/en/posts/2025/01/CVE-2024-11716"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://ctfd.io/"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://blog.ctfd.io/ctfd-3-7-5/"
        },
        {
          "tags": [
            "mailing-list",
            "exploit"
          ],
          "url": "https://seclists.org/fulldisclosure/2024/Dec/21"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
    "assignerShortName": "CERT-PL",
    "cveId": "CVE-2024-11716",
    "datePublished": "2025-01-02T16:07:46.868Z",
    "dateReserved": "2024-11-25T17:36:38.975Z",
    "dateUpdated": "2025-01-02T17:34:54.872Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.