PT-2024-26994 · Targit · Targit Decision Suite

Published 2024-05-29 · Updated 2024-09-27 · CVE-2024-36427

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions TARGIT Decision Suite versions prior to 24.06.19002

Description The issue allows authenticated attackers to read or write to server files via a crafted file request, potentially enabling code execution via a .xview file.

Recommendations For versions prior to 24.06.19002, update to version 24.06.19002 or later to resolve the issue. As a temporary workaround, consider restricting access to the file-serving function to minimize the risk of exploitation. Avoid using crafted file requests in the affected function until the issue is resolved.

Fix

Path traversal

SSRF

Weakness Enumeration

CWE-22

CWE-918

Related Identifiers

CVE-2024-36427

Affected Products

Targit Decision Suite

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-36427 · Security Note
• https://community.targit.com/hc/en-us/articles/16112758176156-Vulnerabilities · Note
• https://t.me/cvenotify/81423 · Telegram Post
• https://github.com/DMCERTCE/DecisionSuite_Path_Traversal_SSRF · Note
• https://t.me/cvenotify/81460 · Telegram Post
• https://t.me/cvenotify/96350 · Telegram Post