CVE-2024-6944
published 2024-07-21CVE-2024-6944: A vulnerability was found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this issue is the function get_image_base64 of the file…
PriorityP353high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
3.78%
88.6th percentile
A vulnerability was found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this issue is the function get_image_base64 of the file PublicController.php. The manipulation of the argument file leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-272066 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| crmeb | crmeb | <= 5.4.0 | — |
| haxx | curl | >= 0 < 7.35.0-1ubuntu2.20+esm18 | 7.35.0-1ubuntu2.20+esm18 |
| haxx | curl | >= 0 < 7.47.0-1ubuntu2.19+esm13 | 7.47.0-1ubuntu2.19+esm13 |
| haxx | curl | >= 0 < 7.58.0-2ubuntu3.24+esm5 | 7.58.0-2ubuntu3.24+esm5 |
| zhongbangkeji | crmeb | — | — |
| zhongbangkeji | crmeb | — | — |
| zhongbangkeji | crmeb | — | — |
| zhongbangkeji | crmeb | — | — |
| zhongbangkeji | crmeb | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
osv6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
curl vulnerability
osv·2024-08-20·CVSS 6.5
CVE-2024-7264 curl vulnerability
curl vulnerability
USN-6944-1 fixed CVE-2024-7264 for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and
Ubuntu 24.04 LTS. This update provides the corresponding fix for
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
Original advisory details:
Dov Murik discovered that curl incorrectly handled parsing ASN.1
Generalized Time fields. A remote attacker could use this issue to cause
curl to crash, resulting in a denial of service, or possibly obtain
sensitive memory contents.
GHSA
GHSA-6w2x-vrj9-f72m: A vulnerability was found in ZhongBangKeJi CRMEB up to 5
ghsa_unreviewed·2024-07-21
CVE-2024-6944 [MEDIUM] CWE-502 GHSA-6w2x-vrj9-f72m: A vulnerability was found in ZhongBangKeJi CRMEB up to 5
A vulnerability was found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this issue is the function get_image_base64 of the file PublicController.php. The manipulation of the argument file leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-272066 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gist.github.com/J1rrY-learn/93a0cf71894570f4eb39344161beb44chttps://vuldb.com/?ctiid.272066https://vuldb.com/?id.272066https://vuldb.com/?submit.374413https://gist.github.com/J1rrY-learn/93a0cf71894570f4eb39344161beb44chttps://vuldb.com/?ctiid.272066https://vuldb.com/?id.272066https://vuldb.com/?submit.374413
2024-07-21
Published