CVE-2024-12138

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-12138
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12138.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-12138
Published
2024-12-04T14:00:14Z
Modified
2026-08-27T03:57:01Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
horilla create_skills deserialization
Details

A vulnerability classified as critical was found in horilla up to 1.2.1. This vulnerability affects the function request_new/get_employee_shift/create_reimbursement/key_result_current_value_update/create_meetings/create_skills. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-20",
        "CWE-502"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12138.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.2.0"
                },
                {
                    "last_affected": "1.2.0"
                },
                {
                    "introduced": "1.2.1"
                },
                {
                    "last_affected": "1.2.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/horilla/horilla-hr

Affected ranges

Type
GIT
Repo
https://github.com/horilla/horilla-hr
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
a3d60220285c305f6498be3c552279dc0192d457
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:horilla:horilla:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.2.1"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

1.*
1.0.0
1.1.0
1.2.0
1.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-12138.json"