PT-2024-16394 · Safenet · Esafenet Cdg 5

0Menc · Published 2024-10-31 · Updated 2024-11-06 · CVE-2024-10597

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ESAFENET CDG 5

Description A critical vulnerability has been found in ESAFENET CDG 5, affecting the function delPolicyAction of the file /com/esafenet/servlet/system/PolicyActionService.java. The manipulation of the argument id leads to SQL injection. It is possible to initiate the attack remotely.

Recommendations To mitigate the risk, update to the latest version and apply all recommended patches. As a temporary workaround, consider restricting access to the vulnerable function delPolicyAction until a patch is available. Ensure you update to the latest version to safeguard your environment.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-10597

Affected Products

Esafenet Cdg 5

References · 16

• 🔥 https://flowus.cn/share/380bcc9d-95ae-4576-b3df-bf3b06f1c5cd?code=G8A6P3 · Exploit
• https://osv.dev/vulnerability/CVE-2024-10597 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10597 · Security Note
• https://twitter.com/transilienceai/status/1853300715650973735 · Twitter Post
• https://vuldb.com/?ctiid.282609 · Note
• https://twitter.com/transilienceai/status/1853300702950662250 · Twitter Post
• https://vuldb.com/?submit.431325 · Note
• https://twitter.com/transilienceai/status/1853300708243886590 · Twitter Post
• https://t.me/cvedetector/9541 · Telegram Post
• https://twitter.com/UndercodeNews/status/1854278072545038341 · Twitter Post
• https://twitter.com/transilienceai/status/1853300720872886563 · Twitter Post
• https://twitter.com/CVEnew/status/1852097292863484389 · Twitter Post
• https://vuldb.com/?id.282609 · Note
• https://twitter.com/transilienceai/status/1853300690493587954 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1852144909223956700 · Twitter Post