by Kastro
Paper/Archive/CVE-2024-8395

CVE-2024-8395

FlyCASS Cockpit Access Security System (CASS) — FlyCASS Cockpit Access Security System (CASS) SQL Injection

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 54.6.546 × 2010.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

FlyCASS CASS and KCM systems did not correctly filter SQL queries, which made them vulnerable to attack by outside attackers with no authentication.

Affected

ProductAffectedFixed inSource
Cockpit Access Security System (CASS)< May 7, 2024May 7, 2024CNA
Known Crewmember (KCM)< May 7, 2024May 7, 2024CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refian.sh/tsa