PT-2024-16432 · Idexpert · Idexpert

Xin-Yue Song + 1 · Published 2024-11-01 · Updated 2024-11-04 · CVE-2024-10653

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IDExpert versions up to 2.8

Description The issue concerns a lack of validation in the administrator interface of IDExpert, allowing remote attackers with administrative privileges to inject and execute OS commands on the server. This can be exploited by injecting a specific parameter.

Recommendations For versions up to 2.8, patch immediately and restrict admin access to minimize the risk of exploitation. Additionally, validate input/output to prevent OS command injection. As a temporary workaround, consider restricting access to the administrator interface until a patch is applied.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-10653

Affected Products

Idexpert

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-10653 · Security Note
• https://t.me/cvenotify/100267 · Telegram Post
• https://twcert.org.tw/tw/cp-132-8174-a17fd-1.html · Note
• https://twitter.com/CVEnew/status/1852300302864748792 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1852342135791448296 · Twitter Post
• https://twitter.com/CveFindCom/status/1852297317052821586 · Twitter Post
• https://twcert.org.tw/en/cp-139-8175-57245-2.html · Note
• https://twitter.com/oktsec/status/1852329145180532975 · Twitter Post
• https://t.me/latest_high_impact_cve/1438 · Telegram Post
• https://t.me/cvedetector/9571 · Telegram Post