{"id":"CVE-2024-24562","aliases":["EUVD-2024-21974","GHSA-gwq3-pvwq-4c9w"],"status":"published","title":"Security headers not set in vantage6-UI","description":"vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addressed in commit `68dfa6614` which is expected to be included in future releases. Users are advised to upgrade when a new release is made. While an upgrade path is not available users may modify the docker image build to insert the headers into nginx.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00349,"percentile":0.28766,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-668","CWE-693"],"published":"2024-03-14T18:52:31Z","modified":"2026-10-28T02:30:59Z","products":[{"vendor":"vantage6","product":"vantage6-ui"}],"references":[{"url":"https://github.com/vantage6/vantage6-UI/security/advisories/GHSA-gwq3-pvwq-4c9w","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/vantage6/vantage6-UI/commit/68dfa661415182da0e5717bd58db3d00aedcbd2e","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24562.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24562","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-24562","title":"Security headers not set in vantage6-UI","description":"vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addressed in commit `68dfa6614` which is expected to be included in future releases. Users are advised to upgrade when a new release is made. While an upgrade path is not available users may modify the docker image build to insert the headers into nginx.\n","status":"published","published":"2024-03-14T18:52:31.109Z","modified":"2024-08-01T23:19:52.915Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-693","CWE-668"],"updated_at":"2026-11-02T14:34:13.991836Z"}],"euvd":[{"id":"EUVD-2024-21974","description":"vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addressed in commit `68dfa6614` which is expected to be included in future releases. Users are advised to upgrade when a new release is made. While an upgrade path is not available users may modify the docker image build to insert the headers into nginx.\n","status":"published","published":"2024-03-14T18:52:31Z","modified":"2024-08-01T23:19:52Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:28.273902Z"}],"nvd":[{"id":"CVE-2024-24562","description":"vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addressed in commit `68dfa6614` which is expected to be included in future releases. Users are advised to upgrade when a new release is made. While an upgrade path is not available users may modify the docker image build to insert the headers into nginx.\n","status":"published","published":"2024-03-14T19:15:49.767Z","modified":"2026-06-17T07:14:36.73Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-668","CWE-693"],"updated_at":"2026-11-02T14:09:40.831473Z"}],"osv":[{"id":"CVE-2024-24562","title":"Security headers not set in vantage6-UI","description":"vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addressed in commit `68dfa6614` which is expected to be included in future releases. Users are advised to upgrade when a new release is made. While an upgrade path is not available users may modify the docker image build to insert the headers into nginx.\n","status":"published","published":"2024-03-14T18:52:31.109Z","modified":"2026-10-28T02:30:59.736759461Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-668","CWE-693"],"updated_at":"2026-11-02T15:44:38.897406Z"}]}}