PT-2024-24615 · Znuny+1 · Znuny Lts+2

Martino Spagnuolo · Published 2024-04-29 · Updated 2025-09-02 · CVE-2024-32493

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Znuny LTS versions 6.5.1 through 6.5.7 Znuny versions 7.0.1 through 7.0.16

Description An issue was discovered where a logged-in agent is able to inject SQL in the draft form ID parameter of an AJAX request.

Recommendations For Znuny LTS versions 6.5.1 through 6.5.7, update to a version outside of this range to resolve the issue. For Znuny versions 7.0.1 through 7.0.16, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the AJAX request endpoint to minimize the risk of exploitation. Avoid using the draft form ID parameter in the affected AJAX request until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-32493

Affected Products

Debian

Znuny

Znuny Lts

References · 12

• https://ubuntu.com/security/CVE-2024-32493 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-32493 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-32493 · Vendor Advisory
• https://znuny.org/en/advisories/zsa-2024-03 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-32493 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32493 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32493 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-32493 · Security Note
• https://t.me/cvenotify/78426 · Telegram Post
• https://twitter.com/CVEnew/status/1784989144021696837 · Twitter Post
• https://znuny.com · Note
• https://t.me/cveNotify/134143 · Telegram Post