Lucene search

VulDBCVE-2024-7704

HistoryAug 12, 2024 - 9:15 p.m.

CVE-2024-7704

2024-08-1221:15:34

CWE-200

VulDB

web.nvd.nist.gov

weaver e-cology 8

source code handler

information disclosure

remote attack

public exploit disclosure

vendor non-response

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS4

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

5.2

Confidence

High

EPSS

Percentile

16.3%

JSON

A vulnerability was found in Weaver e-cology 8. It has been classified as problematic. Affected is an unknown function of the file /cloudstore/ecode/setup/ecology_dev.zip of the component Source Code Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected configurations

Vulners

Vulnrichment

Node

weavere-cologyMatch8

VendorProductVersionCPE
weavere-cology8cpe:2.3:a:weaver:e-cology:8:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
weaver	e-cology	8	cpe:2.3:a:weaver:e-cology:8:::::::*

CNA Affected

[
  {
    "vendor": "Weaver",
    "product": "e-cology",
    "versions": [
      {
        "version": "8",
        "status": "affected"
      }
    ],
    "modules": [
      "Source Code Handler"
    ]
  }
]

References

github.com/Dreamy-elfland/240731

vuldb.com/?ctiid.274182

vuldb.com/?id.274182

vuldb.com/?submit.385494

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS4

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

5.2

Confidence

High

EPSS

Percentile

16.3%

JSON

Related for CVE-2024-7704