Jinan Chicheng Company JFlow 2.0.0 Attachment EntityMutliFile_Load.do AttachmentUploadController oid ବିସ୍ତାରିତ ଅଧିକାର

Rakkoon nageenyaa kan ସମସ୍ୟାଜନକ jedhamuun beekamu Jinan Chicheng Company JFlow 2.0.0 keessatti argameera. Miidhamni argame is hojii AttachmentUploadController faayilii /WF/Ath/EntityMutliFile_Load.do keessa kutaa Attachment Handler keessa. Wanti jijjiirame irratti oid gara ବିସ୍ତାରିତ ଅଧିକାର geessa. Rakkoo ibsuuf CWE yoo fayyadamte gara CWE-284 si geessa. Odeeffannoon kun yeroo 09/19/2024 maxxanfameera. Odeeffannoon kun buufachuuf github.com irratti argama. Dogoggorri kun CVE-2024-9003 jedhamee waamama. Weerara fageenya irraa jalqabuu ni danda'ama. Ibsa teeknikaa ni jira. Waan dabalataa ta’een, meeshaa balaa kana fayyadamuuf ni jira. Qorannoo miidhaa (exploit) uummataaf ifa taasifameera, kanaafis fayyadamuu ni danda'ama. Ammas, gatii exploit might be approx. USD $0-$5k yeroo ammaa irratti argamuu danda'a. ପ୍ରୁଫ୍-ଅଫ୍-କନ୍ସେପ୍ଟ ta’uu isaa ibsameera. Exploit github.com irraa buufachuun ni danda'ama. Akka 0-daytti, gatiin isaa daldala dhoksaa keessatti $0-$5k akka ta'e tilmaamameera. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

2 ଆଡାପ୍ଟେସନ୍ · 77 ପଏଣ୍ଟ

ଫିଲ୍ଡସୃଷ୍ଟି ହୋଇଛି
09/19/2024 04:32 PM		ଅଦ୍ୟତନ 1/1
09/20/2024 10:45 AM
software_vendorJinan Chicheng CompanyJinan Chicheng Company
software_nameJFlowJFlow
software_version2.0.02.0.0
software_componentAttachment HandlerAttachment Handler
software_file/WF/Ath/EntityMutliFile_Load.do/WF/Ath/EntityMutliFile_Load.do
software_functionAttachmentUploadControllerAttachmentUploadController
software_argumentoidoid
vulnerability_cweCWE-284 (ବିସ୍ତାରିତ ଅଧିକାର)CWE-284 (ବିସ୍ତାରିତ ଅଧିକାର)
vulnerability_risk11
cvss3_vuldb_avNN
cvss3_vuldb_acLL
cvss3_vuldb_uiNN
cvss3_vuldb_sUU
cvss3_vuldb_cLL
cvss3_vuldb_iNN
cvss3_vuldb_aNN
cvss3_vuldb_ePP
cvss3_vuldb_rcRR
advisory_urlhttps://github.com/sweatxi/BugHub/blob/main/Jinan%20Gallop%20JFlow%20CMS%20port%20is%20not%20authorized%20to%20cause%20the%20leakage%20of%20database%20attachment%20information.pdfhttps://github.com/sweatxi/BugHub/blob/main/Jinan%20Gallop%20JFlow%20CMS%20port%20is%20not%20authorized%20to%20cause%20the%20leakage%20of%20database%20attachment%20information.pdf
exploit_availability11
exploit_publicity11
exploit_urlhttps://github.com/sweatxi/BugHub/blob/main/Jinan%20Gallop%20JFlow%20CMS%20port%20is%20not%20authorized%20to%20cause%20the%20leakage%20of%20database%20attachment%20information.pdfhttps://github.com/sweatxi/BugHub/blob/main/Jinan%20Gallop%20JFlow%20CMS%20port%20is%20not%20authorized%20to%20cause%20the%20leakage%20of%20database%20attachment%20information.pdf
source_cveCVE-2024-9003CVE-2024-9003
cna_responsibleVulDBVulDB
response_summaryThe vendor was contacted early about this disclosure but did not respond in any way.The vendor was contacted early about this disclosure but did not respond in any way.
cvss2_vuldb_avNN
cvss2_vuldb_acLL
cvss2_vuldb_ciPP
cvss2_vuldb_iiNN
cvss2_vuldb_aiNN
cvss2_vuldb_ePOCPOC
cvss2_vuldb_rcURUR
cvss4_vuldb_avNN
cvss4_vuldb_acLL
cvss4_vuldb_uiNN
cvss4_vuldb_vcLL
cvss4_vuldb_viNN
cvss4_vuldb_vaNN
cvss4_vuldb_ePP
cvss2_vuldb_auSS
cvss2_vuldb_rlNDND
cvss3_vuldb_prLL
cvss3_vuldb_rlXX
cvss4_vuldb_atNN
cvss4_vuldb_prLL
cvss4_vuldb_scNN
cvss4_vuldb_siNN
cvss4_vuldb_saNN
cvss2_vuldb_basescore4.04.0
cvss2_vuldb_tempscore3.43.4
cvss3_vuldb_basescore4.34.3
cvss3_vuldb_tempscore3.93.9
cvss3_meta_basescore4.34.3
cvss3_meta_tempscore3.94.1
cvss4_vuldb_bscore5.35.3
cvss4_vuldb_btscore2.12.1
advisory_date1726696800 (09/19/2024)1726696800 (09/19/2024)
price_0day$0-$5k$0-$5k
cve_nvd_summaryA vulnerability was found in Jinan Chicheng Company JFlow 2.0.0. It has been rated as problematic. This issue affects the function AttachmentUploadController of the file /WF/Ath/EntityMutliFile_Load.do of the component Attachment Handler. The manipulation of the argument oid leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
cve_nvd_summaryesSe ha encontrado una vulnerabilidad en Jinan Chicheng Company JFlow 2.0.0. Se ha calificado como problemática. Este problema afecta a la función AttachmentUploadController del archivo /WF/Ath/EntityMutliFile_Load.do del componente Attachment Handler. La manipulación del argumento oid genera controles de acceso inadecuados. El ataque puede iniciarse de forma remota. El exploit se ha divulgado al público y puede utilizarse. Se contactó primeramente con el proveedor sobre esta divulgación, pero no respondió de ninguna manera.
cvss3_cna_avN
cvss3_cna_acL
cvss3_cna_prL
cvss3_cna_uiN
cvss3_cna_sU
cvss3_cna_cL
cvss3_cna_iN
cvss3_cna_aN
cvss3_cna_basescore4.3
cvss2_cna_avN
cvss2_cna_acL
cvss2_cna_auS
cvss2_cna_ciP
cvss2_cna_iiN
cvss2_cna_aiN
cvss2_cna_basescore4

◂ ପଛକୁସମୀକ୍ଷାଆହୁରି ଦୂରରେ ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!