Arbitrary File Write Vulnerability in Chunghwa Telecom's TenderDocTransfer Application

CVE-2024-12642

What is CVE-2024-12642?

CVE-2024-12642 represents a critical Arbitrary File Write vulnerability found in the TenderDocTransfer application developed by Chunghwa Telecom. This security flaw stems from the application’s lack of adequate Cross-Site Request Forgery (CSRF) protection on its APIs, allowing unauthenticated remote attackers to exploit the APIs via phishing attacks. Moreover, a significant Relative Path Traversal weakness enables malicious users to write arbitrary files to any directory on a target system without proper authorization. As a result, organizations using this software should take immediate action to assess and mitigate potential risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References