Products
Tronclass from WisdomGarden
Source
twcert@cert.org.tw
Tags
CVE-2024-6738 details
Published : July 15, 2024, 3:15 a.m.
Last Modified : July 15, 2024, 1 p.m.
Last Modified : July 15, 2024, 1 p.m.
Description
The tumbnail API of Tronclass from WisdomGarden lacks proper access control, allowing unauthenticated remote attackers to obtain certain specific files by modifying the URL.
CVSS Score
| 1 | 2 | 3 | 4 | 5.3 | 6 | 7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-284 | Improper Access Control | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
Base Score
5.3
Exploitability Score
3.9
Impact Score
1.4
Base Severity
MEDIUM
Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
| URL | Source |
|---|---|
| https://www.twcert.org.tw/en/cp-139-7926-f7914-2.html | twcert@cert.org.tw |
| https://www.twcert.org.tw/tw/cp-132-7925-97e1c-1.html | twcert@cert.org.tw |
This website uses the NVD API, but is not approved or certified by it.