CVE-2024-13042

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-13042
A vulnerability was found in Tsinghua Unigroup Electronic Archives Management System 3.2.210802(62532). It has been classified as problematic. Affected is the function download of the file /Searchnew/Subject/download.html. The manipulation of the argument path leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://github.com/BxYQ/zg_fileread
https://github.com/BxYQ/zg_fileread/blob/main/poc.py
https://vuldb.com/?ctiid.289788
https://vuldb.com/?id.289788
https://vuldb.com/?submit.472068
Configurations

No configuration.

History

04 Jan 2025, 13:15

Type Values Removed Values Added
Summary
  • (es) Se ha encontrado una vulnerabilidad en Tsinghua Unigroup Electronic Archives Management System 3.2.210802(62532). Se ha clasificado como problemática. La función de descarga del archivo SubjectController.class.php está afectada. La manipulación de la ruta de argumentos conduce a la divulgación de información. Es posible lanzar el ataque de forma remota. El exploit se ha hecho público y puede utilizarse.
Summary (en) A vulnerability was found in Tsinghua Unigroup Electronic Archives Management System 3.2.210802(62532). It has been classified as problematic. Affected is the function download of the file SubjectController.class.php. The manipulation of the argument path leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. (en) A vulnerability was found in Tsinghua Unigroup Electronic Archives Management System 3.2.210802(62532). It has been classified as problematic. Affected is the function download of the file /Searchnew/Subject/download.html. The manipulation of the argument path leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

30 Dec 2024, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-30 21:15

Updated : 2025-01-04 13:15

NVD link : CVE-2024-13042

Mitre link : CVE-2024-13042

CVE.ORG link : CVE-2024-13042

JSON object : View

Products Affected

No product.

CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-284

Improper Access Control