by Kastro
Paper/Archive/CVE-2024-9984

CVE-2024-9984

Ragic Enterprise Cloud Database — Ragic Enterprise Cloud Database - Missing Authentication

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 47.2.472 × 209.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Enterprise Cloud Database from Ragic does not authenticate access to specific functionality, allowing unauthenticated remote attackers to use this functionality to obtain any user's session cookie.

Affected

ProductAffectedFixed inSource
Enterprise Cloud Database< 2024/08/08 09:45:252024/08/08 09:45:25CNA
enterprise_cloud_database< 2024-08-082024-08-08CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-8150-c955a-1.htmlwriteuptwcert.org.tw/en/cp-139-8151-1a4b5-2.html