Paper/Archive/CVE-2024-29732

CVE-2024-29732

Abast SCAN_VISIO eDocument Suite Web Viewer — SQL Injection vulnerability on SCAN_VISIO eDocument Suite Web Viewer from Abast

EPSS 0.5%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 45.9.459 × 209.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A SQL Injection has been found on SCAN_VISIO eDocument Suite Web Viewer of Abast. This vulnerability allows an unauthenticated user to retrieve, update and delete all the information of database. This vulnerability was found on login page via "user" parameter.

Affected

ProductAffectedFixed inSource

SCAN_VISIO eDocument Suite Web Viewer3.28.1–CNA

scan_visio_edocument_suite_web_viewer3.28.1–CISA-ADP

Scores by source

INCIBE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refincibe.es/en/incibe-cert/notices/aviso/sql-injection-vulnerability-scanvisio-edocument-suite-web-viewer-abast