GroupMe allows an a unauthenticated attacker to elevate privileges over a network by convincing a user to click on a malicious link.</p> CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"/>GroupMe allows an a unauthenticated attacker to elevate privileges over a network by convincing a user to click on a malicious link.</p> CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"/>

CVE-2024-38183

Server-Side Request Forgery (SSRF) (CWE-918)

Published: Sep 17, 2024

010
CVSS 8.8EPSS 0.09%High
CVE info copied to clipboard

Summary

An improper access control vulnerability in GroupMe allows an unauthenticated attacker to elevate privileges over a network by convincing a user to click on a malicious link.

Impact

This vulnerability has a high impact on confidentiality, integrity, and availability. It allows an unauthenticated attacker to gain elevated privileges, potentially compromising the affected system's security. The attack can be executed over a network, increasing its reach and potential for widespread exploitation.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. Microsoft has released updates to address this vulnerability.

Mitigation

1. Apply the security updates provided by Microsoft as soon as possible. 2. Implement user awareness training to help users identify and avoid clicking on suspicious links. 3. Consider implementing additional network security measures, such as intrusion detection/prevention systems, to detect and block potential exploit attempts. 4. Limit network access to the affected GroupMe application where possible. 5. Monitor for any suspicious activities or unauthorized access attempts in systems running GroupMe.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Timeline

CVE Assignment

NVD published the first details for CVE-2024-38183

Sep 17, 2024 at 7:15 PM
First Article

Feedly found the first article mentioning CVE-2024-38183. See article

Sep 17, 2024 at 7:21 PM / Vulners.com RSS Feed
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Sep 17, 2024 at 7:21 PM
EPSS

EPSS Score was set to: 0.09% (Percentile: 39.6%)

Sep 18, 2024 at 9:31 AM
EPSS

EPSS Score was set to: 0.11% (Percentile: 44.4%)

Nov 19, 2024 at 2:38 PM
Static CVE Timeline Graph

Affected Systems

Microsoft/groupme
+null more

Patches

Microsoft
+null more

Attack Patterns

CAPEC-664: Server Side Request Forgery
+null more

References

GroupMe Elevation of Privilege Vulnerability
An improper access control vulnerability in GroupMe allows an a unauthenticated attacker to elevate privileges over a network by convincing a user to click on a malicious link. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?

News

CVE-2024-38183 GroupMe Elevation of Privilege Vulnerability
Vulnerability Summary for the Week of September 16, 2024
High Vulnerabilities Primary Vendor — Product Description Published CVSS Score Source & Patch Info CIRCUTOR–CIRCUTOR Q-SMT CIRCUTOR Q-SMT in its firmware version 1.0.4, could be affected by a denial of service (DoS) attack if an attacker with access to the web service bypasses the authentication mechanisms on the login page, allowing the attacker to use all the functionalities implemented at web level that allow interacting with the device. 2024-09-18 10 CVE-2024-8887 cve-coordination@incibe.es CIRCUTOR–CIRCUTOR Q-SMT An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network captures, locally stored web information, etc. 2024-09-18 10 CVE-2024-8888 cve-coordination@incibe.es dragonflyoss–Dragonfly2 Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation (CNCF) as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, “Secret Key”, is hard coded, which leads to authentication bypass. An attacker can perform any action as a user with admin privileges. This issue has been addressed in release version 2.0.9. All users are advised to upgrade.
Patch Tuesday October 2024 - Five Zero Days
Besides these zero days we have five CVE's rated critical: These mainly affect Windows OS's as well as MS Configuration Manager and some one offs for Dynamics and the GroupMe app. CVE-2024-43572 is a remote code execution vulnerability with a rating of important.
An improper access control vulnerability in GroupMe
An improper access control vulnerability in GroupMe allows an a unauthenticated attacker to elevate privileges over a network by convincing a user to click on a malicious link.
US-CERT Vulnerability Summary for the Week of September 16, 2024
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High : vulnerabilities with a CVSS base score of 7.0–10.0 Medium : vulnerabilities with a CVSS base score of 4.0–6.9 Low : vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links.
See 11 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:Required
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI