PT-2024-16391 · Safenet · Esafenet Cdg 5

0Menc

+1

·

Published

2024-10-31

·

Updated

2024-11-05

·

CVE-2024-10594

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions ESAFENET CDG 5
Description A critical issue has been found in ESAFENET CDG 5, affecting the docHistory function of the file /com/esafenet/servlet/fileManagement/FileDirectoryService.java. The manipulation of the fileId argument leads to SQL injection. This issue can be exploited remotely. The vendor was contacted about this disclosure but did not respond.
Recommendations As a temporary workaround, consider disabling the docHistory function until a patch is available. Restrict access to the /com/esafenet/servlet/fileManagement/FileDirectoryService.java file to minimize the risk of exploitation. Avoid using the fileId argument in the affected function until the issue is resolved. Update to the latest release to mitigate risks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-10594

Affected Products

Esafenet Cdg 5