PT-2024-25138 · J2Eefast · J2Eefast

Published 2024-05-07 · Updated 2024-07-03 · CVE-2024-33161

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions J2EEFAST version 2.7.0

Description The issue is related to a SQL injection vulnerability. It occurs via the sql filter parameter in the unallocatedList() function. This allows for potential exploitation.

Recommendations For J2EEFAST version 2.7.0, consider restricting access to the unallocatedList() function until a patch is available. As a temporary workaround, avoid using the sql filter parameter in the affected function to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-33161

Affected Products

J2Eefast

References · 5

• https://osv.dev/vulnerability/CVE-2024-33161 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-33161 · Security Note
• https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/33161.txt · Note
• https://twitter.com/CVEnew/status/1787888416169853097 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1787915587168985578 · Twitter Post