PT-2024-17911 · Unknown · Electronic Official Document Management System

Liyu Hung + 1 · Published 2024-12-31 · Updated 2025-01-02 · CVE-2024-13061

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Electronic Official Document Management System (affected versions not specified)

Description The Electronic Official Document Management System has an Authentication Bypass issue. Although the product enforces an IP whitelist for the API used to query user tokens, unauthenticated remote attackers can still deceive the server to obtain tokens of arbitrary users, which can then be used to log into the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2024-13061

Affected Products

Electronic Official Document Management System

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-13061 · Security Note
• https://t.me/latest_high_impact_cve/1737 · Telegram Post
• https://twitter.com/CVEnew/status/1874054038259462412 · Twitter Post
• https://chtsecurity.com/news/255984da-6630-4e25-ba9b-5ce6933935a6 · Note
• https://twitter.com/VulmonFeeds/status/1874071028336378139 · Twitter Post
• https://twcert.org.tw/tw/cp-132-8339-570fa-1.html · Note
• https://twcert.org.tw/en/cp-139-8340-d8b16-2.html · Note
• https://t.me/cvenotify/105811 · Telegram Post
• https://t.me/cvedetector/14005 · Telegram Post
• https://twitter.com/CveFindCom/status/1874055754740633839 · Twitter Post
• https://chtsecurity.com/news/ade9e9af-61d0-4e3c-8aa0-e8524ee2cfbc · Note
• https://t.me/cvenotify/105935 · Telegram Post