CVE-2024-9922
Relative Path Traversal (CWE-23)
Published: Oct 14, 2024 / Updated: 37d ago
010
CVSS 7.5EPSS 0.09%High
CVE info copied to clipboard
The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Timeline
CVE Assignment
NVD published the first details for CVE-2024-9922
Oct 14, 2024 at 3:15 AM
CVSS
A CVSS base score of 7.5 has been assigned.
Oct 14, 2024 at 3:20 AM / nvd
First Article
Feedly found the first article mentioning CVE-2024-9922. See article
Oct 14, 2024 at 3:24 AM / National Vulnerability Database
CVSS Estimate
Feedly estimated the CVSS score as MEDIUM
Oct 14, 2024 at 3:24 AM
EPSS
EPSS Score was set to: 0.09% (Percentile: 37.8%)
Oct 14, 2024 at 9:47 AM
Affected Systems
Teamplus/team\+_pro
+null more
Attack Patterns
CAPEC-139: Relative Path Traversal
+null more
News
CVE Alert: CVE-2024-9922 - https://www. redpacketsecurity.com/cve_aler t_cve-2024-9922/ # OSINT # ThreatIntel # CyberSecurity # cve_2024_9922
CVE Alert: CVE-2024-9922
Everyone that supports the site helps enable new functionality. Affected Endpoints:
CVE-2024-9921 (CVSS 9.8): Critical Flaw Found in Popular Business Collaboration Tool Team+ [app] [cloud] [exp]
TWCERT/CC identified critical security vulnerabilities in Team+ by TEAMPLUS TECHNOLOGY, including a SQL injection flaw and path traversal vulnerabilities, urging users to update to version 14.0.0 or later to prevent unauthorized access to sensitive data.
CVE-2024-9921 (CVSS 9.8): Critical Flaw Found in Popular Business Collaboration Tool Team+
The most severe vulnerability, identified as CVE-2024-9921 and assigned a critical CVSS score of 9.8, allows unauthenticated attackers to inject malicious SQL commands. CVE-2024-9922 (CVSS 7.5) allows unauthenticated attackers to read arbitrary system files, potentially exposing confidential configurations or sensitive system information.
High - CVE-2024-9922 - The Team+ from TEAMPLUS TECHNOLOGY does not...
The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.
See 8 more articles and social media posts