Products
UNKNOWN
Source
cybersecurity@hitachienergy.com
Tags
CVE-2024-3980 details
Published : Aug. 27, 2024, 1:15 p.m.
Last Modified : Aug. 27, 2024, 3:52 p.m.
Last Modified : Aug. 27, 2024, 3:52 p.m.
Description
The product allows user input to control or influence paths or file names that are used in filesystem operations, allowing the attacker to access or modify system files or other files that are critical to the application.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9.9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Base Score
9.9
Exploitability Score
3.1
Impact Score
6.0
Base Severity
CRITICAL
Vector String : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
| URL | Source |
|---|---|
| https://publisher.hitachienergy.com/preview?DocumentID=8DBD000160&LanguageCode=en&DocumentPartId=&Action=Launch | cybersecurity@hitachienergy.com |
This website uses the NVD API, but is not approved or certified by it.