CVE-2024-11220

Katalog CVE

CVSS 7.8 · High EPSS 0,15%

Kerentanan Incorrect Execution-Assigned Permissions pada openautomationsoftware open automation software. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A local low-level user on the server machine with credentials to the running OAS services can create and execute a report with an rdlx file on the server system itself. Any code within the rdlx file of the report executes with SYSTEM privileges, resulting in privilege escalation.

Rincian

Terbit di NVD

6 Desember 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-279: Incorrect Execution-Assigned Permissions
CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,15% peluang dieksploitasi; lebih tinggi dari 3,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-03 pemerintah AS
• https://openautomationsoftware.com/downloads/ product