CVE-2024-8780

Published Sep 16, 2024

Last updated 5 months ago

CVSS medium 6.5

Overview

Description: OMFLOW from The SYSCOM Group does not properly restrict the query range of its data query functionality, allowing remote attackers with regular privileges to obtain accounts and password hashes of other users.
Source: twcert@cert.org.tw
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.5
Impact score: 3.6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo
twcert@cert.org.tw: CWE-200

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:syscomgo:omflow:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2C7046D4-C41E-4D5A-8596-F800F1911ECB",
            "versionEndIncluding": "1.2.1.3"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References