CVE-2024-13189
Published: 08 January 2025
Summary
CVE-2024-13189 is a medium-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Zerowdd Myblog. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-13189 is a critical vulnerability in ZeroWdd myblog 1.0, affecting an unknown part of the file src/main/java/com/wdd/myblog/config/MyBlogMvcConfig.java. The issue stems from permission problems, mapped to CWE-266 and CWE-275, with a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). It was published on 2025-01-08.
The vulnerability enables remote exploitation by unauthenticated attackers (PR:N) over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Manipulation leads to permission issues, allowing limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L).
Details on the vulnerability, including the publicly disclosed exploit, are documented in GitHub issues at https://github.com/ZeroWdd/myblog/issues/1 and https://github.com/ZeroWdd/myblog/issues/1#issue-2759828006, as well as VulDB entries at https://vuldb.com/?ctiid.290781, https://vuldb.com/?id.290781, and https://vuldb.com/?submit.469223. No specific patch or mitigation details are provided in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51411
Vulnerability details
A vulnerability classified as critical has been found in ZeroWdd myblog 1.0. This affects an unknown part of the file src/main/java/com/wdd/myblog/config/MyBlogMvcConfig.java. The manipulation leads to permission issues. It is possible to initiate the attack remotely. The exploit has been disclosed…
more
to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Critical permission bypass in public-facing web application (ZeroWdd myblog MVC config) allows remote unauthenticated access to admin paths, enabling exploitation of public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for logical access, directly countering the permission bypass vulnerability in MyBlogMvcConfig.java.
Identifies, reports, and corrects the specific flaw causing permission issues (CWE-266, CWE-275), preventing remote exploitation of this CVE.
Employs least privilege to limit unauthorized access enabled by incorrect privilege assignments in the vulnerable MVC configuration.