CVE-2024-24562CWE-668CWE-693

Security headers not set in vantage6-UI

Medium · published March 14, 2024

CVSS v3.1
5.4
EPSS
0%
Percentile
27.3
In the wild
Unconfirmed
What it is

vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addressed in commit `68dfa6614` which is expected to be included in future releases. Users are advised to upgrade when a new release is made. While an upgrade path is not available users may modify the docker image build to insert the headers into nginx.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00349 · 27.3th percentile
Weaknesses
CWE-668 · Exposure of Resource to Wrong Sphere; CWE-693 · Protection Mechanism Failure
Published
2024-03-14T18:52Z
EPSS history
Timeline
  • 14 MAR 18:52Z
    Security headers not set in vantage6-UI
    cvelistv5