PT-2024-16393 · Safenet · Esafenet Cdg

0Menc + 1 · Published 2024-10-31 · Updated 2024-11-05 · CVE-2024-10596

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ESAFENET CDG 5

Description A critical issue was found in ESAFENET CDG, affecting the function delEntryptPolicySort of the file /com/esafenet/servlet/system/EncryptPolicyTypeService.java. The manipulation of the argument id leads to SQL injection. The attack may be launched remotely.

Recommendations For ESAFENET CDG 5, update to the latest patched version immediately to mitigate risks. As a temporary workaround, consider disabling the delEntryptPolicySort function until a patch is available. Restrict access to the /com/esafenet/servlet/system/EncryptPolicyTypeService.java file to minimize the risk of exploitation. Avoid using the argument id in the affected function until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-10596

Affected Products

Esafenet Cdg

References · 12

• 🔥 https://flowus.cn/share/0c59c0ea-9624-42b5-9e06-66fab39b773c?code=G8A6P3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-10596 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10596 · Vendor Advisory
• https://vuldb.com/?ctiid.282608 · Note
• https://twitter.com/transilienceai/status/1853300673632444810 · Twitter Post
• https://vuldb.com/?submit.431307 · Note
• https://twitter.com/VulmonFeeds/status/1852152588864491889 · Twitter Post
• https://twitter.com/CVEnew/status/1852097293849166198 · Twitter Post
• https://vuldb.com/?id.282608 · Note
• https://t.me/cvedetector/9540 · Telegram Post
• https://twitter.com/UndercodeNews/status/1853880416865865913 · Twitter Post
• https://twitter.com/transilienceai/status/1853300682624991309 · Twitter Post