PT-2024-16003 · Opensight+1 · Flashfxp+1

Tfhm · Published 2024-10-17 · Updated 2024-10-22 · CVE-2024-10068

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenSight Software FlashFXP version 5.4.0.3970

Description A critical issue was found in the library libcrypto-1 1.dll of the file FlashFXP.exe, affecting an unknown function. This leads to uncontrolled search path manipulation. The attack must be approached locally, and the exploit has been disclosed to the public. The vendor was contacted about this disclosure but did not respond.

Recommendations As a temporary workaround, consider restricting access to the library libcrypto-1 1.dll to minimize the risk of exploitation. Review file permissions to mitigate the risk of local exploit. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2024-10068

Affected Products

Flashfxp

Libcrypt++

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-10068 · Security Note
• https://t.me/cvedetector/8164 · Telegram Post
• https://twitter.com/CveFindCom/status/1846876955485802860 · Twitter Post
• https://twitter.com/oktsec/status/1846817839421817170 · Twitter Post
• https://vuldb.com/?id.280716 · Note
• https://t.me/latest_high_impact_cve/1351 · Telegram Post
• https://t.me/cvenotify/98442 · Telegram Post
• https://vuldb.com/?submit.419684 · Note
• https://twitter.com/CVEnew/status/1846875754744738045 · Twitter Post
• https://twitter.com/cracbot/status/1848605351178080527 · Twitter Post
• https://vuldb.com/?ctiid.280716 · Note