CVE-2024-6943

Katalog CVE

CVSS 8.8 · High EPSS 0,61%

Kerentanan Deserialization of Untrusted Data pada crmeb. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability has been found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this vulnerability is the function downloadImage of the file app/services/product/product/CopyTaobaoServices.php. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272065 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Rincian

Terbit di NVD

21 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?submit.374394 advisory pihak ketiga
• https://gist.github.com/J1rrY-learn/e15a1926a3b5a2b8805a15cb95eff1d7 broken link
• https://vuldb.com/?ctiid.272065 permissions required
• https://vuldb.com/?id.272065 permissions required