Description

Digiwin EasyFlow .NET lacks proper access control for specific functionality, and the functionality do not adequately filter user input. A remote attacker with regular privilege can exploit this vulnerability to download arbitrary files from the remote server .

Related CPE's

a

digiwin

easyflow_.net

Vulnerable

References

https://www.twcert.org.tw/en/cp-139-7990-87183-2.html

Third Party Advisory

https://www.twcert.org.tw/tw/cp-132-7989-9c4ea-1.html

Third Party Advisory

Weaknesses

[email protected]

Primary
CWE-22

[email protected]

Secondary
CWE-36

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.5 · Medium

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2024-08-02T11:16:44.220

7 months ago

Last modified

2024-09-11T14:22:46.903

6 months ago