PT-2024-28021 · Shenzhen Guoxin · Shenzhen Guoxin Synthesis Image System

Published 2024-06-16 · Updated 2024-07-03 · CVE-2024-38467

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Shenzhen Guoxin Synthesis image system versions prior to 8.3.0

Description The issue allows unauthorized user information retrieval. This is achieved via the "queryUser API" endpoint.

Recommendations For versions prior to 8.3.0, update to version 8.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "queryUser API" endpoint until a patch is available.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-38467

Affected Products

Shenzhen Guoxin Synthesis Image System

References · 4

• 🔥❌ https://github.com/Pumpkin-ito/Cve-Vuln/blob/main/Guosen%20synthetic%20imaging%20system%20vulnerability.pdf · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2024-38467 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38467 · Security Note
• https://t.me/cvenotify/83432 · Telegram Post