Vulnerabilities

TI-2024-25143 CVE-2024-37770 · GHSA-cxrx-w35f-hjjq

14Finger v1.1 was discovered to contain a remote command execution (RCE) vulnerability in…

HIGH 74

14Finger v1.1 was discovered to contain a remote command execution (RCE) vulnerability in the fingerprint function.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0157 Published 2024-07-10 No fix listed CWE-94

TI-2024-25142 CVE-2024-37769 · GHSA-2v2c-wv9c-g6cm

HIGH 73

Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00459 Published 2024-07-05 No fix listed CWE-278

TI-2024-25141 CVE-2024-37768 · GHSA-f33q-f757-3cjh

MEDIUM 40

14Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00572 Published 2024-07-05 No fix listed

TI-2024-25140 CVE-2024-37767 · GHSA-p36x-j8pc-9vcr

LOW 39

Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information via a crafted GET request.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00396 Published 2024-07-05 No fix listed CWE-306