8.8

CVE-2024-8779

The SYSCOM Group OMFLOW - Broken Access Control

OMFLOW from The SYSCOM Group does not properly restrict access to the system settings modification functionality, allowing remote attackers with regular privileges to update system settings or create accounts with administrator privileges, thereby gaining control of the server.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Syscomgo ≫ Omflow Version >= 1.1.6.0 < 1.2.1.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.54% 0.413
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
twcert@cert.org.tw 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://www.twcert.org.tw/en/cp-139-8076-6ade0-2.html
Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-8075-a0d06-1.html
Third Party Advisory