CVE-2024-9923
Relative Path Traversal (CWE-23)
Published: Oct 14, 2024 / Updated: 37d ago
010
CVSS 4.9EPSS 0.05%Medium
CVE info copied to clipboard
The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with administrator privileges to move arbitrary system files to the website root directory and access them.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Timeline
CVE Assignment
NVD published the first details for CVE-2024-9923
Oct 14, 2024 at 4:15 AM
First Article
Feedly found the first article mentioning CVE-2024-9923. See article
Oct 14, 2024 at 4:21 AM / National Vulnerability Database
CVSS Estimate
Feedly estimated the CVSS score as HIGH
Oct 14, 2024 at 4:21 AM
EPSS
EPSS Score was set to: 0.05% (Percentile: 19%)
Oct 14, 2024 at 9:47 AM
Affected Systems
Teamplus/team\+_pro
+null more
Attack Patterns
CAPEC-139: Relative Path Traversal
+null more
News
CVE Alert: CVE-2024-9923 - https://www. redpacketsecurity.com/cve_aler t_cve-2024-9923/ # OSINT # ThreatIntel # CyberSecurity # cve_2024_9923
CVE Alert: CVE-2024-9923
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
CVE-2024-9921 (CVSS 9.8): Critical Flaw Found in Popular Business Collaboration Tool Team+ [app] [cloud] [exp]
TWCERT/CC identified critical security vulnerabilities in Team+ by TEAMPLUS TECHNOLOGY, including a SQL injection flaw and path traversal vulnerabilities, urging users to update to version 14.0.0 or later to prevent unauthorized access to sensitive data.
CVE-2024-9921 (CVSS 9.8): Critical Flaw Found in Popular Business Collaboration Tool Team+
The most severe vulnerability, identified as CVE-2024-9921 and assigned a critical CVSS score of 9.8, allows unauthenticated attackers to inject malicious SQL commands. CVE-2024-9922 (CVSS 7.5) allows unauthenticated attackers to read arbitrary system files, potentially exposing confidential configurations or sensitive system information.
CVE-2024-9923
Medium Severity Description The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with administrator privileges to move arbitrary system files to the website root directory and access them. Read more at https://www.tenable.com/cve/CVE-2024-9923
See 8 more articles and social media posts