PT-2024-17286 · Plextrac · Plextrac

Ianis Bernard · Published 2024-12-13 · Updated 2024-12-13 · CVE-2024-11839

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/U:Red

Name of the Vulnerable Software and Affected Versions PlexTrac versions 1.61.3 through 2.8.1

Description The issue is related to the deserialization of untrusted data in PlexTrac, specifically in the Runbooks modules, allowing object injection and arbitrary file writes. This enables attackers to perform malicious actions.

Recommendations For versions 1.61.3 through 2.8.1, update to version 2.8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Runbooks modules to minimize the risk of exploitation. Avoid using the affected modules until the issue is resolved.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-11839

Affected Products

Plextrac

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-11839 · Security Note
• https://osv.dev/vulnerability/CVE-2024-11839 · Vendor Advisory
• https://docs.plextrac.com/plextrac-documentation/master/security-advisories#release-2.11.0 · Note
• https://t.me/cvedetector/12829 · Telegram Post
• https://twitter.com/CVEnew/status/1867537611507527697 · Twitter Post
• https://twitter.com/CveFindCom/status/1867449859453735057 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1867475116029825528 · Twitter Post
• https://t.me/latest_high_impact_cve/1645 · Telegram Post