PT-2024-27493 · Unknown · Smart Office

Ahmed8199 · Published 2024-04-13 · Updated 2024-07-19 · CVE-2024-3735

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Smart Office versions up to 20240405

Description A vulnerability was found in the file Main.aspx, where the manipulation of the New Password/Confirm Password argument with the input 1 leads to weak password requirements. The attack can be launched remotely, with a rather high complexity and difficult exploitability. The exploit has been disclosed to the public and may be used.

Recommendations For versions up to 20240405, consider temporarily restricting the use of the New Password/Confirm Password argument until a patch is available. As a mitigation measure, ensure strong password requirements are enforced to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2024-3735

Affected Products

Smart Office

References · 8

• 🔥 https://mega.nz/file/7F0BSJhD#EvnXFRviBstJGHSafvLmVWosWH2JFPAouD6ER8wnGxk · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-3735 · Security Note
• https://twitter.com/VulmonFeeds/status/1779158960639021445 · Twitter Post
• https://t.me/cvenotify/76673 · Telegram Post
• https://t.me/cvenotify/86577 · Telegram Post
• https://vuldb.com/?ctiid.260574 · Note
• https://vuldb.com/?id.260574 · Note
• https://vuldb.com/?submit.311153 · Note