by Kastro
Paper/Archive/CVE-2024-26261

CVE-2024-26261

Hgiga OAKlouds — Hgiga OAKlouds - Arbitrary File Read And Delete

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 52.4.524 × 2010.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability. Attackers can put file path in specific request parameters, allowing them to download the file without login. Furthermore, the file will be deleted after being downloaded.

Affected

ProductAffectedFixed inSource
OAKloudsearlier – < 188188CNA
OAKloudsearlier – < 10511051CNA
oaklouds-organization< 188188CISA-ADP
oaklouds-organization< 188188CISA-ADP
oaklouds-webbase< 10511051CISA-ADP
oaklouds-webbase< 10511051CISA-ADP

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-7674-bdb40-1.htmlwriteupchtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96