Paper/Archive/CVE-2024-40404

CVE-2024-40404

cybelesoft thinfinity_workspace — Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the API endpoint where Web So…

EPSS 0.5%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 39.7.397 × 207.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain an access control issue in the API endpoint where Web Sockets connections are established.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

thinfinity_workspace< 7.0.2.1137.0.2.113CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refblog.cybelesoft.com/thinfinity-workspace-security-bulletin-nov-2024