1. Home
  2. CVE Database
  3. CVE-2024-24725
HIGH · 8.8

CVE-2024-24725

Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&s...

Vulnerability Description

Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
GibboneduGibbon<= 26.0.00

Related Weaknesses (CWE)

CWE-502

References

FAQ

What is CVE-2024-24725?

CVE-2024-24725 is a vulnerability with a CVSS score of 8.8 (HIGH). Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&s...

How severe is CVE-2024-24725?

CVE-2024-24725 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-24725?

Check the references section above for vendor advisories and patch information. Affected products include: Gibbonedu Gibbon.