CVE-2024-9982

{"id": "CVE-2024-9982", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "twcert@cert.org.tw", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-10-15T08:15:03.603", "references": [{"url": "https://www.twcert.org.tw/en/cp-139-8147-eb650-2.html", "source": "twcert@cert.org.tw"}, {"url": "https://www.twcert.org.tw/tw/cp-132-8146-497a2-1.html", "source": "twcert@cert.org.tw"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "twcert@cert.org.tw", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "AIM LINE Marketing Platform from Esi Technology does not properly validate a specific query parameter. When the LINE Campaign Module is enabled, unauthenticated remote attackers can inject arbitrary FetchXml commands to read, modify, and delete database content."}, {"lang": "es", "value": "La plataforma de marketing AIM LINE de Esi Technology no valida correctamente un par\u00e1metro de consulta espec\u00edfico. Cuando el m\u00f3dulo de campa\u00f1a LINE est\u00e1 habilitado, atacantes remotos no autenticados pueden inyectar comandos FetchXml arbitrarios para leer, modificar y eliminar contenido de la base de datos."}], "lastModified": "2024-10-15T12:57:46.880", "sourceIdentifier": "twcert@cert.org.tw"}