CVE-2024-27292
Published: 21 March 2024
Summary
CVE-2024-27292 is a high-severity Use of Incorrectly-Resolved Name or Reference (CWE-706) vulnerability in Jhpyle Docassemble. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Docassemble, an expert system for guided interviews and document assembly, contains a vulnerability in versions 1.4.53 through 1.4.96 that enables unauthorized information disclosure through URL manipulation. The flaw is tracked as CWE-706 and carries a CVSS 3.1 score of 7.5, reflecting network-accessible attack vectors with no required credentials or user interaction and a high impact on confidentiality.
An unauthenticated attacker can exploit the issue by crafting malicious URLs to retrieve sensitive data stored on the system. Because the attack requires only network connectivity and succeeds without authentication, it can be launched from anywhere with reachability to a vulnerable Docassemble instance.
The project has addressed the flaw in release 1.4.97 of the master branch. Details and the corrective commit are published in GitHub Security Advisory GHSA-jq57-3w7p-vwvv. The current EPSS score of 0.9383, with a peak of 0.9391, indicates sustained exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-0665
Vulnerability details
Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version…
more
1.4.97 of the master branch.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables exploitation of a public-facing web application through URL manipulation to gain unauthorized access to information on the system.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.