PT-2024-22034 · Clarisa · Filemaker Server

Published 2024-04-26 · Updated 2024-12-09 · CVE-2024-27790

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FileMaker Server versions prior to 20.3.2

Description The issue potentially allowed unauthorized access to records stored in databases hosted on FileMaker Server. This was resolved by validating transactions before replying to client requests.

Recommendations For versions prior to 20.3.2, update to FileMaker Server 20.3.2 to fix the issue by validating transactions before replying to client requests.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-27790

Affected Products

Filemaker Server

References · 10

• https://support.claris.com/s/answerview?anum=000041674&language=en_US · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27790 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27790 · Security Note
• https://twitter.com/Dinosn/status/1785501965813735792 · Twitter Post
• https://t.me/pentestingnews/46461 · Telegram Post
• https://twitter.com/Komodosec/status/1785794353254039700 · Twitter Post
• https://twitter.com/fridaysecurity/status/1785501596266217748 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1785500088380649528 · Twitter Post
• https://twitter.com/CVEnew/status/1783883460962095233 · Twitter Post
• https://t.me/cvenotify/103606 · Telegram Post