PT-2024-38686 · Anhui Deshun Intelligent Technology · Jielink+ Jsotc2016

Sanbao + 1 · Published 2024-08-18 · Updated 2024-08-23 · CVE-2024-7919

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805

Description A critical issue has been found in the processing of the file /report/ParkChargeRecord/GetDataList, leading to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations For Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805, patch immediately and review access permissions to mitigate the risk of remote exploitation. As a temporary workaround, consider restricting access to the /report/ParkChargeRecord/GetDataList file until a patch is available.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-7919

Affected Products

Jielink+ Jsotc2016

References · 15

• 🔥 https://wiki.shikangsi.com/post/share/fd390bd7-2d60-4ffb-87da-f72cc900f61c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-7919 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7919 · Vendor Advisory
• https://twitter.com/cracbot/status/1826862028109349183 · Twitter Post
• https://twitter.com/CVEnew/status/1825337820279460070 · Twitter Post
• https://twitter.com/oktsec/status/1825612293507346891 · Twitter Post
• https://vuldb.com/?id.275069 · Note
• https://twitter.com/VulmonFeeds/status/1825409895228686672 · Twitter Post
• https://vuldb.com/?submit.387124 · Note
• https://twitter.com/cracbot/status/1827224369774694725 · Twitter Post
• https://t.me/cvenotify/91085 · Telegram Post
• https://t.me/cvenotify/91478 · Telegram Post
• https://vuldb.com/?ctiid.275069 · Note
• https://t.me/cvedetector/3501 · Telegram Post
• https://twitter.com/CveFindCom/status/1826703650363781260 · Twitter Post