by Kastro
Paper/Archive/CVE-2024-13061

CVE-2024-13061

2100 Technology Electronic Official Document Management System — 2100 Technology Electronic Official Document Management System - Authentication Bypass

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 70.9.709 × 2014.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Electronic Official Document Management System from 2100 Technology has an Authentication Bypass vulnerability. Although the product enforces an IP whitelist for the API used to query user tokens, unauthenticated remote attackers can still deceive the server to obtain tokens of arbitrary users, which can then be used to log into the system.

Affected

ProductAffectedFixed inSource
Official Document Management System< 5.0.86.95.0.86.9CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-8339-570fa-1.htmlwriteuptwcert.org.tw/en/cp-139-8340-d8b16-2.htmlwriteupchtsecurity.com/news/ade9e9af-61d0-4e3c-8aa0-e8524ee2cfbcwriteupchtsecurity.com/news/255984da-6630-4e25-ba9b-5ce6933935a6