CVE-2024-55889
Phpmyfaq ≤ 3.2.10
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:NSummary
CVE-2024-55889 is a medium-severity User Interface (UI) Misrepresentation of Critical Information (CWE-451) vulnerability in Phpmyfaq Phpmyfaq. Its CVSS base score is 4.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Phishing (T1566); ranked in the top 19% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
phpMyFAQ is an open source FAQ web application that contains a vulnerability in its FAQ Record component prior to version 3.2.10. The flaw permits a privileged attacker to force an unintended file download on a visiting user's system by embedding a crafted reference inside an <iframe> element, which triggers automatically without user interaction or consent. The issue is tracked as CWE-451 and carries a CVSS 3.1 score of 4.9 reflecting network attack vector, low complexity, high privileges required, and high integrity impact with no confidentiality or availability effects.
An authenticated administrator or other high-privileged user can exploit the weakness by placing the iframe in content that a victim will view, resulting in the browser initiating a file download on the victim's machine. Because the vector requires no user interaction and works across the network, the attacker can achieve unauthorized modification of the victim's local environment through forced downloads.
The project addressed the issue in release 3.2.10. The accompanying GitHub Security Advisory GHSA-m3r7-8gw7-qwvc and the referenced commit fa0f7368dc3288eedb1915def64ef8fb270f711d document the fix and recommend that administrators upgrade promptly to eliminate the iframe-based download behavior.
EPSS for the CVE remains at 0.0919 with no material increase from its initial value, indicating limited observed exploitation interest to date.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-3486
Vulnerability Data
phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can trigger a file download on a victim's machine upon page visit by embedding it in…
more
an <iframe> element without user interaction or explicit consent. Version 3.2.10 fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly address design and implementation of accurate, non-spoofable UI elements.
User awareness training helps people recognize and avoid harm from UI misrepresentation such as phishing, but does not prevent the flaw itself.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect UI misrepresentation vulnerabilities before deployment.
Security awareness training can teach users to recognize UI misrepresentation and phishing attempts.
Web filtering can block known phishing sites that exploit UI misrepresentation.
Secure development lifecycle includes UI/UX security requirements that can prevent misrepresentation of critical information.
Application security requirements can mandate proper display and validation of critical information in the UI.
Secure coding practices can prevent UI flaws that obscure or spoof critical information.