Paper/Archive/CVE-2024-28048

CVE-2024-28048

Fortunefield ffBull — OS command injection vulnerability exists in ffBull ver.4.11, which may allow a remote unauthenticated attacker to execute an arbitrary O…

EPSS 1%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 69.9.699 × 2014.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

OS command injection vulnerability exists in ffBull ver.4.11, which may allow a remote unauthenticated attacker to execute an arbitrary OS command with the privilege of the running web server. Note that the developer was unreachable, therefore, users should consider stop using ffBull ver.4.11.

Affected

ProductAffectedFixed inSource

ffBullver.4.11–CNA

ffbull4.11–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refjvn.jp/en/jp/JVN17176449