PT-2024-38688 · Anhui Deshun Intelligent Technology · Jielink+ Jsotc2016

Sanbao + 1 · Published 2024-08-18 · Updated 2024-08-23 · CVE-2024-7921

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805

Description A vulnerability has been found in the software, classified as problematic, and affects an unknown functionality of the file /report/ParkOutRecord/GetDataList. The manipulation leads to improper access controls. The attack can be launched remotely.

Recommendations For Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805, as a temporary workaround, consider restricting access to the /report/ParkOutRecord/GetDataList file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-7921

Affected Products

Jielink+ Jsotc2016

References · 14

• 🔥 https://wiki.shikangsi.com/post/share/7d5eb025-1c30-44b4-b609-61938f6d6c05 · Exploit
• https://osv.dev/vulnerability/CVE-2024-7921 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7921 · Security Note
• https://twitter.com/cracbot/status/1827224379224412271 · Twitter Post
• https://t.me/cvenotify/91483 · Telegram Post
• https://t.me/cvedetector/3507 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1825406113212141572 · Twitter Post
• https://vuldb.com/?submit.387126 · Note
• https://t.me/cvenotify/91092 · Telegram Post
• https://twitter.com/cracbot/status/1826862038791999607 · Twitter Post
• https://twitter.com/CveFindCom/status/1826688394719625530 · Twitter Post
• https://vuldb.com/?ctiid.275071 · Note
• https://twitter.com/CVEnew/status/1825364166959325579 · Twitter Post
• https://vuldb.com/?id.275071 · Note