PT-2024-37773 · Zmops · Argusdbm

Aftersnow · Published 2024-07-10 · Updated 2024-07-11 · CVE-2024-6644

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions zmops ArgusDBM version 0.1.0

Description A critical issue was found in the getDefaultClassLoader function of the CalculateAlarm.java file, part of the AviatorScript Handler component. This issue leads to deserialization and can be exploited remotely. The exploit has been disclosed publicly.

Recommendations For version 0.1.0, consider disabling the getDefaultClassLoader function of the CalculateAlarm.java file as a temporary workaround until a patch is available. Restrict access to the AviatorScript Handler component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-6644

Affected Products

Argusdbm

References · 10

• 🔥 https://github.com/zmops/ArgusDBM/issues/64 · Exploit
• https://osv.dev/vulnerability/CVE-2024-6644 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6644 · Security Note
• https://vuldb.com/?submit.367347 · Note
• https://twitter.com/CVEnew/status/1811322726638051334 · Twitter Post
• https://t.me/cvedetector/556 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1811106092245479819 · Twitter Post
• https://vuldb.com/?id.271050 · Note
• https://vuldb.com/?ctiid.271050 · Note
• https://t.me/cvenotify/85708 · Telegram Post