CVE-2024-9142
External Control of File Name or Path (CWE-73)
Published: Sep 25, 2024 / Updated: 56d ago

010

CVSS 9.4EPSS 0.04%Critical

CVE info copied to clipboard

Summary

External Control of File Name or Path and Incorrect Permission Assignment for Critical Resource vulnerability in Olgu Computer Systems e-Belediye allows Manipulating Web Input to File System Calls. This issue affects e-Belediye versions before 2.0.642.

Impact

This vulnerability has a critical severity with a CVSS v3.1 base score of 9.8 and a CVSS v4.0 base score of 9.4. The impact is severe across all three main security aspects: 1. Confidentiality: High impact, potentially allowing unauthorized access to sensitive information. 2. Integrity: High impact, possibly enabling attackers to modify or manipulate data. 3. Availability: High impact, which could result in system disruptions or denial of service. The vulnerability requires no user interaction and can be exploited over the network with low attack complexity. This means that remote attackers could potentially exploit this vulnerability with relative ease, leading to unauthorized file access, manipulation, or execution of malicious code on the affected systems.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. The vulnerability affects e-Belediye versions before 2.0.642. To mitigate this issue, it is crucial to upgrade to version 2.0.642 or later.

Mitigation

1. Immediate patching: Update e-Belediye to version 2.0.642 or later as soon as possible. 2. Access Control: Implement strict access controls and file permissions on critical resources. 3. Input Validation: Enhance input validation mechanisms, particularly for file system-related operations. 4. Network Segmentation: Limit network exposure of the e-Belediye application to reduce the attack surface. 5. Monitoring: Implement robust logging and monitoring to detect any suspicious file system activities or unauthorized access attempts. 6. Regular Security Audits: Conduct frequent security assessments to identify and address similar vulnerabilities. 7. Principle of Least Privilege: Ensure that the application runs with minimal necessary permissions.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Timeline

CVE Assignment

NVD published the first details for CVE-2024-9142

Sep 25, 2024 at 1:15 AM

First Article

Feedly found the first article mentioning CVE-2024-9142. See article

Sep 25, 2024 at 1:24 AM / National Vulnerability Database

CVSS Estimate

Feedly estimated the CVSS score as HIGH

Sep 25, 2024 at 1:24 AM

CVSS

A CVSS base score of 9.8 has been assigned.

Sep 25, 2024 at 1:41 AM / nvd

EPSS

EPSS Score was set to: 0.04% (Percentile: 9.6%)

Sep 25, 2024 at 10:26 AM

Threat Intelligence Report

CVE-2024-9142 is a critical vulnerability in e-Belediye, with a CVSS score of 10.0, that allows external manipulation of file paths, resulting in incorrect permission assignments for critical resources in Olgu Computer Systems. The provided information does not indicate whether the vulnerability is being exploited in the wild, nor does it mention any proof-of-concept exploits, mitigations, detections, or patches available. Additionally, there is no information regarding potential downstream impacts on other third-party vendors or technologies. See article

Sep 27, 2024 at 5:36 AM