VulnerabilityAnalyzed
CVE-2024-10598
A vulnerability classified as critical was found in Tongda OA 11.2/11.3/11.4/11.5/11.6.
MEDIUM 6.9EPSS 0.53%
Does this matter?
Lower severity and a low EPSS score (0.53%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability classified as critical was found in Tongda OA 11.2/11.3/11.4/11.5/11.6. This vulnerability affects unknown code of the file general/hr/setting/attendance/leave/data.php of the component Annual Leave Handler. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- CVSS 4.0
- 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.53% probability · 43th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-285, CWE-862
- Affected
- tongda2000/office anywhere
- Source
- cna@vuldb.com
References
- https://github.com/LvZCh/td/issues/1Exploit, Third Party Advisory
- https://vuldb.com/?ctiid.282610Permissions Required, VDB Entry
- https://vuldb.com/?id.282610Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.433495Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.