CVE-2024-10599mediumCWE-400

CVE-2024-10599: medium-severity vulnerability in Tongda OA 2017

Tongda OA 2017 package_static_resources.php resource consumption

Published · Updated

Follow this CVE+ Monitor OA

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 1.0%
In short

Tongda OA 2017 has a flaw in a file that processes package resources, allowing attackers to consume excessive server resources remotely. This can slow down or crash the application, affecting availability for legitimate users.

Technical detail

CWE-400 resource exhaustion vulnerability in /inc/package_static_resources.php allows unauthenticated remote attackers to trigger uncontrolled resource consumption through malicious requests, impacting system availability. The vulnerability affects Tongda OA 2017 up to version 11.7.

Summary generated and translated by AI from the official description.
A vulnerability, which was classified as problematic, has been found in Tongda OA 2017 up to 11.7. This issue affects some unknown processing of the file /inc/package_static_resources.php. The manipulation leads to resource consumption. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
Tongda · OA 2017
Related CVEs — Tongda OA 2017

In the same product, most dangerous first.

CVE-2024-10600MEDIUMTongda OA 2017 submenu.php sql injectionEPSS 6.6%CVE-2023-6053MEDIUMTongda OA 2017 delete.php sql injectionEPSS 1.2%CVE-2023-6052MEDIUMTongda OA 2017 delete.php sql injectionEPSS 1.2%CVE-2023-6054MEDIUMTongda OA 2017 lock.php sql injectionEPSS 1.1%CVE-2023-6084MEDIUMTongda OA 2017 delete.php sql injectionEPSS 1.0%CVE-2023-5267MEDIUMTongda OA 2017 delete.php sql injectionEPSS 0.9%