{"id":"CVE-2024-36076","aliases":["EUVD-2024-35875","GHSA-2vfc-3h43-vghh","GHSA-rw3m-9ff4-qmp2"],"status":"published","title":"Syslifters SysReptor before 2024.40 has a CSRF vulnerability for WebSocket connections.","description":"Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a malicious same-site subdomain in the same browser session.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00247,"percentile":0.16115,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2024-05-19T19:22:49Z","modified":"2026-10-28T02:30:49Z","products":[{"vendor":"syslifters","product":"sysreptor"}],"references":[{"url":"https://github.com/Syslifters/sysreptor/releases/tag/2024.40","tags":["x_transferred","Release Notes","web"]},{"url":"https://github.com/Syslifters/sysreptor/security/advisories/GHSA-2vfc-3h43-vghh","tags":["x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36076","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rw3m-9ff4-qmp2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36076.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-36076","description":"Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a malicious same-site subdomain in the same browser session.","status":"published","published":"2024-05-19T19:22:49.111Z","modified":"2025-02-13T15:59:15.557Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:34:14.649724Z"}],"euvd":[{"id":"EUVD-2024-35875","description":"Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a malicious same-site subdomain in the same browser session.","status":"published","published":"2024-05-19T19:22:49Z","modified":"2025-02-13T15:59:15Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:03:53.726571Z"}],"ghsa":[{"id":"GHSA-rw3m-9ff4-qmp2","title":"Syslifters SysReptor before 2024.40 has a CSRF vulnerability for WebSocket connections.","description":"Syslifters SysReptor before 2024.40 has a CSRF vulnerability for WebSocket connections.","status":"published","published":"2024-05-19T21:30:23Z","modified":"2024-07-03T18:43:35Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:57:37.066336Z"}],"nvd":[{"id":"CVE-2024-36076","description":"Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a malicious same-site subdomain in the same browser session.","status":"published","published":"2024-05-19T20:15:07.97Z","modified":"2026-06-17T07:36:05.607Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:10:01.327642Z"}],"osv":[{"id":"CVE-2024-36076","description":"Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a malicious same-site subdomain in the same browser session.","status":"published","published":"2024-05-19T19:22:49.111Z","modified":"2026-10-28T02:30:49.419682435Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:40.704083Z"}]}}