PT-2024-39938 · Team+ · Team+

Ginoah + 1 · Published 2024-10-13 · Updated 2024-10-24 · CVE-2024-9923

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Team+ versions 13.5.x

Description The issue arises from the improper validation of a specific page parameter, allowing remote attackers with administrator privileges to move arbitrary system files to the website root directory and access them. This can lead to unauthorized data access.

Recommendations For version 13.5.x, apply the available patch to fix the issue and monitor for potential exploit development. Assess exposure and apply defense-in-depth measures to minimize the risk of exploitation. As a temporary workaround, consider restricting access to sensitive system files and directories until the patch is applied.

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2024-9923

Affected Products

Team+

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-9923 · Security Note
• https://osv.dev/vulnerability/CVE-2024-9923 · Vendor Advisory
• https://t.me/cvedetector/7797 · Telegram Post
• https://t.me/cvenotify/99328 · Telegram Post
• https://twitter.com/CVEnew/status/1845671307507109928 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1845699564994539787 · Twitter Post
• https://twcert.org.tw/en/cp-139-8129-00002-2.html · Note
• https://twitter.com/oktsec/status/1845700489414894029 · Twitter Post
• https://twcert.org.tw/tw/cp-132-8128-772aa-1.html · Note