CVE-2024-1032

HIGH

openBI < 1.0.8 - Deserialization of Untrusted Data via Test Connection Handler

Title source: llm

Description

A vulnerability classified as critical was found in openBI up to 1.0.8. Affected by this vulnerability is the function testConnection of the file /application/index/controller/Databasesource.php of the component Test Connection Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252307.

References (3)

Core 3

Core References

Permissions Required vdb-entry technical-description

https://vuldb.com/?id.252307

Permissions Required signature permissions-required

https://vuldb.com/?ctiid.252307

Broken Link broken-link exploit

https://note.zhaoj.in/share/6ISYe2urjlkI

Scores

CVSS v3 7.3

EPSS 0.0076

EPSS Percentile 50.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-502

Status published

Products (1)

openbi_project/openbi < 1.0.8

Published Jan 30, 2024

Tracked Since Feb 18, 2026