CVE-2024-8651 Netcat CMS: user enumeration
Attackers can enumerate valid users via crafted HTTP requests, facilitating further attacks; administrators should apply vendor patches.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-8651?
CVE-2024-8651 is a medium-severity vulnerability in NetCat CMS, published on 19 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in NetCat CMS allows an attacker to send a specially crafted http request that can be used to check whether a user exists in the system, which could be a basis for further attacks. This issue affects NetCat CMS v. 6.4.0.24126.2 and possibly others.
Apply patch from vendor https://netcat.ru/ https://netcat.ru/] . Versions 6.4.0.24248 and on have the patch.
Which versions are affected by CVE-2024-8651?
It affects 1 product.
Products include Netcat Netcat Content Management System.
How do I fix CVE-2024-8651?
No fix has been published for CVE-2024-8651 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-8651 being exploited?
There is no known exploitation of CVE-2024-8651 in the wild and no public exploit code.
Other vulnerabilities in NetCat CMS
Sources
Also known as GHSA-6gcw-xcpf-vr88.