PT-2024-21656 · Unknown · Soplanning

Hidde Smit + 1 · Published 2024-09-11 · Updated 2024-09-19 · CVE-2024-27114

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SO Planning versions prior to 1.52.02

Description A Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. If the public view setting is enabled, an attacker can upload a PHP-file that will be available for execution for a few milliseconds before it is removed, leading to execution of code on the underlying system.

Recommendations For versions prior to 1.52.02, update to version 1.52.02 to resolve the issue. As a temporary workaround, consider disabling the public view setting until the update is applied. Restrict access to the PHP-file upload feature to minimize the risk of exploitation.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2024-27114

Affected Products

Soplanning

References · 8

• https://osv.dev/vulnerability/CVE-2024-27114 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27114 · Security Note
• https://t.me/cvedetector/5358 · Telegram Post
• https://twitter.com/CveFindCom/status/1833868683065635035 · Twitter Post
• https://twitter.com/CVEnew/status/1833865955069591732 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1833911050795647207 · Twitter Post
• https://csirt.divd.nl/CVE-2024-27114 · Note
• https://twitter.com/oktsec/status/1833886791788552698 · Twitter Post