PT-2024-21659 · Unknown · Comfortkey

Alwin Warringa + 1 · Published 2024-08-14 · Updated 2024-08-20 · CVE-2024-27120

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/S:P/AU:Y/R:U/V:C/RE:M/U:Red

Name of the Vulnerable Software and Affected Versions ComfortKey versions prior to 24.1.2

Description A Local File Inclusion issue has been found in ComfortKey, allowing an unauthenticated attacker to retrieve sensitive system information.

Recommendations For versions prior to 24.1.2, update to version 24.1.2 to resolve the issue. As a temporary workaround, consider restricting access to sensitive system files until the update is applied.

Fix

Path traversal

Information Disclosure

Weakness Enumeration

CWE-22

CWE-200

Related Identifiers

CVE-2024-27120

Affected Products

Comfortkey

References · 9

• https://osv.dev/vulnerability/CVE-2024-27120 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27120 · Security Note
• https://twitter.com/VulmonFeeds/status/1824012083999981637 · Twitter Post
• https://t.me/cvedetector/3205 · Telegram Post
• https://t.me/cvenotify/91404 · Telegram Post
• https://t.me/cvenotify/90715 · Telegram Post
• https://csirt.divd.nl/CVE-2024-27120 · Note
• https://csirt.divd.nl/DIVD-2024-00031 · Note
• https://twitter.com/CVEnew/status/1823819263733534869 · Twitter Post