Lucene search

TwcertCVE-2024-7323

HistoryAug 02, 2024 - 11:16 a.m.

CVE-2024-7323

2024-08-0211:16:44

CWE-36

CWE-22

twcert

web.nvd.nist.gov

cve-2024-7323

digiwin easyflow

access control

user input

remote attacker

arbitrary files

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

19.8%

JSON

Digiwin EasyFlow .NET lacks proper access control for specific functionality, and the functionality do not adequately filter user input. A remote attacker with regular privilege can exploit this vulnerability to download arbitrary files from the remote server .

Affected configurations

Nvd

Node

digiwineasyflow_.netRange<6.6.17

VendorProductVersionCPE
digiwineasyflow_.net*cpe:2.3:a:digiwin:easyflow_.net:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
digiwin	easyflow_.net	*	cpe:2.3:a:digiwin:easyflow_.net::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "EasyFlow .NET",
    "vendor": "Digiwin",
    "versions": [
      {
        "status": "affected",
        "version": "5.*"
      },
      {
        "status": "affected",
        "version": "6.1.*"
      },
      {
        "status": "affected",
        "version": "6.6.*"
      }
    ]
  }
]

References

www.twcert.org.tw/en/cp-139-7990-87183-2.html

www.twcert.org.tw/tw/cp-132-7989-9c4ea-1.html

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

19.8%

JSON

Related for CVE-2024-7323