Lucene search

VulDBVULNRICHMENT:CVE-2024-7704

HistoryAug 12, 2024 - 8:31 p.m.

CVE-2024-7704 Weaver e-cology Source Code ecology_dev.zip information disclosure

2024-08-1220:31:03

CWE-200

VulDB

github.com

weaver e-cology

source code handler

information disclosure

remote attack

vendor disclosure

cve-2024-7704

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS4

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

6.5

Confidence

Low

EPSS

Percentile

16.3%

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

partial

JSON

A vulnerability was found in Weaver e-cology 8. It has been classified as problematic. Affected is an unknown function of the file /cloudstore/ecode/setup/ecology_dev.zip of the component Source Code Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CNA Affected

[
  {
    "vendor": "Weaver",
    "product": "e-cology",
    "versions": [
      {
        "version": "8",
        "status": "affected"
      }
    ],
    "modules": [
      "Source Code Handler"
    ]
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:weaver:e-cology:8:*:*:*:*:*:*:*"
    ],
    "vendor": "weaver",
    "product": "e-cology",
    "versions": [
      {
        "status": "affected",
        "version": "8"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

github.com/Dreamy-elfland/240731

vuldb.com/?ctiid.274182

vuldb.com/?id.274182

vuldb.com/?submit.385494

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS4

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

6.5

Confidence

Low

EPSS

Percentile

16.3%

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-7704