PT-2024-23861 · Unknown · Changing Mobile

Vtim · Published 2024-07-01 · Updated 2024-07-01 · CVE-2024-3122

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CHANGING Mobile (affected versions not specified)

Description The issue concerns the Mobile One Time Password functionality, which does not properly filter parameters for the file download feature. This allows remote attackers with administrator privileges to read arbitrary files on the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2024-3122

Affected Products

Changing Mobile

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-3122 · Security Note
• https://twcert.org.tw/tw/cp-132-7911-0962e-1.html · Note
• https://twcert.org.tw/en/cp-139-7912-4c800-2.html · Note