CVE-2024-0988mediumCWE-287

CVE-2024-0988: falha de média gravidade em Sichuan Yougou Technology KuERP

Sichuan Yougou Technology KuERP common.php checklogin improper authentication

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar KuERP

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 1.0%
A vulnerability classified as critical was found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected by this vulnerability is the function checklogin of the file /application/index/common.php. The manipulation of the argument App_User_id/App_user_Token leads to improper authentication. The exploit has been disclosed to the public and may be used. The identifier VDB-252253 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
Sichuan Yougou Technology · KuERP
CVEs relacionadas — Sichuan Yougou Technology KuERP

No mesmo produto, das mais perigosas para as menos.

CVE-2024-0989MEDIUMSichuan Yougou Technology KuERP Service.php del_sn_db path traversalEPSS 1.2%CVE-2024-0987MEDIUMSichuan Yougou Technology KuERP log neutralization for logsEPSS 0.9%