---
cve: "CVE-2024-51381"
severity: "HIGH"
cvss: 8.4
epss: "0.2%"
vendor: "n/a"
kev: false
exploited: false
published: "2024-11-05 19:15:07"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-10-27T21:42:24+01:00"
---

# CVE-2024-51381

> 8.4 HIGH

## Beschreibung

Cross-Site Request Forgery (CSRF) vulnerability in JATOS v3.9.3 that allows attackers to perform actions reserved for administrators, including creating admin accounts. This critical flaw can lead to unauthorized activities, compromising the security and integrity of the platform, especially if an attacker gains administrative control.

## CNA-Record (Kanon, cvelistV5)

- CNA: **mitre**
- State: PUBLISHED
- Stand: 2024-11-06 16:50:31

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Hoch | good |
| UI Interaktion | Erforderlich | good |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-352** — Cross-Site Request Forgery (CSRF)
  The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

## Angriffsmuster (CAPEC)

- [CAPEC-62 — Cross Site Request Forgery](https://capec.mitre.org/data/definitions/62.html) _(Severity: Very High)_
- [CAPEC-111 — JSON Hijacking (aka JavaScript Hijacking)](https://capec.mitre.org/data/definitions/111.html) _(Severity: High)_
- [CAPEC-462 — Cross-Domain Search Timing](https://capec.mitre.org/data/definitions/462.html) _(Severity: Medium)_
- [CAPEC-467 — Cross Site Identification](https://capec.mitre.org/data/definitions/467.html) _(Severity: Low)_

## Referenzen

- <https://hacking-notes.medium.com/cve-2024-51381-jatos-v3-9-3-csrf-admin-account-creation-94035f24d0be>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2024-51381/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_