PT-2024-37833 · 2100 Technology · Electronic Official Document Management System

Published 2024-07-15 · Updated 2024-07-16 · CVE-2024-6737

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Electronic Official Document Management System from 2100 TECHNOLOGY (affected versions not specified)

Description The issue concerns improper implementation of access control in the system, allowing remote attackers with regular privileges to access account settings functionality. This access enables them to create an administrator account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-6737

Affected Products

Electronic Official Document Management System

References · 7

• https://osv.dev/vulnerability/CVE-2024-6737 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6737 · Security Note
• https://twcert.org.tw/tw/cp-132-7923-46df3-1.html · Note
• https://t.me/cvedetector/832 · Telegram Post
• https://t.me/cvenotify/86189 · Telegram Post
• https://t.me/cvenotify/86319 · Telegram Post
• https://twcert.org.tw/en/cp-139-7924-85606-2.html · Note