CVE-2024-8504highCWE-78

CVE-2024-8504: falha de alta gravidade em VICIdial

VICIdial Authenticated Remote Code Execution

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar VICIdial

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

58Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 8.8epss 76%
da publicação à armano mesmo dia
Publicada no NVD10 de set.
metasploit10 de set.
An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
VICIdial · VICIdial
CVEs relacionadas — VICIdial

No mesmo produto, das mais perigosas para as menos.

CVE-2024-8503CRITICALVICIdial Unauthenticated SQL InjectionEPSS 79.3%CVE-2022-34876MEDIUMVICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple SQL injection vulnerability at /vicidial/admin.php.EPSS 3.4%CVE-2022-34877MEDIUMVICIDial 2.14b0.5 SVN 3550 was discovered to contains a SQL injection vulnerability at /vicidial/AST_agent_time_sheet.php.EPSS 3.4%CVE-2022-34878MEDIUMVICIDial 2.14b0.5 SVN 3550 was discovered to contain a SQL injection vulnerability at /vicidial/user_stats.php.EPSS 3.4%CVE-2022-34879MEDIUMVICIDial 2.14b0.5 SVN 3550 was discovered to contain multiple Cross Site Scripting (XSS) vulnerabilities at /vicidial/admin.php.EPSS 0.5%