{"answers":{"affected":"2 open source packages ship an affected version, including privatebin/privatebin.","exploited":"There is no known exploitation of CVE-2024-39899 in the wild and no public exploit code.","fix":"Upgrade privatebin/privatebin to 1.7.4 or later.","what":"CVE-2024-39899 is a medium-severity vulnerability in PrivateBin, published on 9 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-39899 and fix it if it is affected.\n\nWhat it is: CVE-2024-39899 is a medium-severity vulnerability in PrivateBin, published on 9 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2024-39899 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- privatebin/privatebin (Packagist): affected from 1.5.0; fixed in 1.7.4\n- privatebin/privatebin (Packagist): affected from 1.5.0; fixed in 1.7.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-39899/ (Markdown: https://insights.sbomify.com/CVE-2024-39899/index.md)","id":"CVE-2024-39899","markdown":"https://insights.sbomify.com/CVE-2024-39899/index.md","name":"CVE-2024-39899","record":{"aliases":["GHSA-mqqj-fx8h-437j"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"PrivateBin pastebin","requires_auth":"none","summary":"Attackers can bypass URL shortening restrictions to shorten arbitrary external URLs, potentially facilitating phishing or spam campaigns.","user_interaction":"not_required","vuln_class":"open_redirect"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":5.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-791","name":"Incomplete Filtering of Special Elements"},{"id":"CWE-305","name":"Authentication Bypass by Primary Weakness"}],"description":"PrivateBin is an online pastebin where the server has zero knowledge of pasted data. In v1.5, PrivateBin introduced the YOURLS server-side proxy. The idea was to allow using the YOURLs URL shortener without running the YOURLs instance without authentication and/or exposing the authentication token to the public, allowing anyone to shorten any URL. With the proxy mechanism, anyone can shorten any URL pointing to the configured PrivateBin instance. The vulnerability allowed other URLs to be shortened, as long as they contain the PrivateBin instance, defeating the limit imposed by the proxy. This vulnerability is fixed in 1.7.4.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"PrivateBin allows shortening of URLs for other domains","id":"CVE-2024-39899","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"open_redirect","year":"2024"},"n_packages":2,"n_references":3,"next":{"headline":"OpenSearch Dashboards Reports does not properly restrict access to private tenant resources","id":"CVE-2024-39900"},"packages":[{"ecosystem":"Packagist","fixed":["1.7.4"],"introduced":["1.5.0"],"last_affected":[],"package":"privatebin/privatebin","purl":null,"source":"GHSA-mqqj-fx8h-437j"},{"ecosystem":"Packagist","fixed":["1.7.4"],"introduced":["1.5.0"],"last_affected":[],"package":"privatebin/privatebin","purl":"pkg:composer/privatebin/privatebin","source":"GHSA-mqqj-fx8h-437j"}],"prev":{"headline":"Cache driver GetBlob() allows read access to any blob without access control check","id":"CVE-2024-39897"},"products":["PrivateBin"],"published":"2024-07-09","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-08-02","vendors":["PrivateBin"]},"summary":"Attackers can bypass URL shortening restrictions to shorten arbitrary external URLs, potentially facilitating phishing or spam campaigns.","url":"https://insights.sbomify.com/CVE-2024-39899/"}