Unauthenticated Remote Attackers Can Modify Parameters and Conduct SSRF Attacks
CVE-2024-4894

5.3MEDIUM

Key Information:

Vendor

Itpison

Status
Omicard Edm
Vendor
CVE Published:
15 May 2024

What is CVE-2024-4894?

ITPison OMICARD EDM fails to properly filter specific URL parameter, allowing unauthenticated remote attackers to modify the parameters and conduct Server-Side Request Forgery (SSRF) attacks. This vulnerability enables attackers to probe internal network information.

Affected Version(s)

OMICARD EDM earlier < 6.0

References

https://www.twcert.org.tw/tw/cp-132-7802-18f3c-1.html
third-party-advisory
https://www.twcert.org.tw/en/cp-139-7803-c0f73-2.html
third-party-advisory

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.