VulnerabilityAnalyzed
CVE-2024-3704
SQL Injection Vulnerability has been found on OpenGnsys product affecting version 1.1.1d (Espeto).
CRITICAL 9.8EPSS 0.73%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.73%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
SQL Injection Vulnerability has been found on OpenGnsys product affecting version 1.1.1d (Espeto). This vulnerability allows an attacker to inject malicious SQL code into login page to bypass it or even retrieve all the information stored in the database.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.73% probability · 52th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- opengnsys/opengnsys
- Source
- cve-coordination@incibe.es
References
- https://opengnsys.es/web/parche-de-seguridad-cve-2024-370xVendor Advisory
- https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-opengnsysThird Party Advisory
- https://opengnsys.es/web/parche-de-seguridad-cve-2024-370xVendor Advisory
- https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-opengnsysThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.