CVE-2024-3122

Published: Jul 1, 2024Modified: Jun 17, 2026Deferred

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.2 / Impact: 3.6

Source: twcert@cert.org.tw (Secondary)

Description

CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privilege to read arbitrary file on the system.

Related CWEs

CWE-23

Relative Path Traversal

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

References (4)

https://www.twcert.org.tw/en/cp-139-7912-4c800-2.html

Source: twcert@cert.org.tw

https://www.twcert.org.tw/tw/cp-132-7911-0962e-1.html

Source: twcert@cert.org.tw

https://www.twcert.org.tw/en/cp-139-7912-4c800-2.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.twcert.org.tw/tw/cp-132-7911-0962e-1.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.