Lucene search

TwcertVULNRICHMENT:CVE-2024-7323

HistoryAug 02, 2024 - 10:36 a.m.

CVE-2024-7323 Digiwin EasyFlow .NET - Arbitrary File Download

2024-08-0210:36:51

CWE-36

twcert

github.com

digiwin easyflow

access control

input filtering

arbitrary file download

remote server

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

19.8%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Digiwin EasyFlow .NET lacks proper access control for specific functionality, and the functionality do not adequately filter user input. A remote attacker with regular privilege can exploit this vulnerability to download arbitrary files from the remote server .

CNA Affected

[
  {
    "vendor": "Digiwin",
    "product": "EasyFlow .NET",
    "versions": [
      {
        "status": "affected",
        "version": "5.*"
      },
      {
        "status": "affected",
        "version": "6.1.*"
      },
      {
        "status": "affected",
        "version": "6.6.*"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

www.twcert.org.tw/en/cp-139-7990-87183-2.html

www.twcert.org.tw/tw/cp-132-7989-9c4ea-1.html

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

19.8%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-7323