The eHRD CTMS from Sunnet has an Insecure Direct Object Reference (IDOR) vulnerability, allowing unauthenticated remote attackers to modify a specific parameter to access arbitrary files uploaded by any user.
References
| Link | Resource |
|---|---|
| https://www.twcert.org.tw/en/cp-139-8167-a2c0d-2.html | Third Party Advisory |
| https://www.twcert.org.tw/tw/cp-132-8166-085c4-1.html | Third Party Advisory |
Configurations
History
25 Sep 2025, 14:13
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Sun.net ehrd Ctms
|
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| CPE | cpe:2.3:a:sun.net:ehrd_ctms:*:*:*:*:*:*:*:* |
31 Oct 2024, 00:35
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:sun.net:ehdr_ctms:*:*:*:*:*:*:*:* | |
| First Time |
Sun.net
Sun.net ehdr Ctms |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| References | () https://www.twcert.org.tw/en/cp-139-8167-a2c0d-2.html - Third Party Advisory | |
| References | () https://www.twcert.org.tw/tw/cp-132-8166-085c4-1.html - Third Party Advisory |
28 Oct 2024, 13:58
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
28 Oct 2024, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-10-28 03:15
Updated : 2025-09-25 14:13
NVD link : CVE-2024-10439
Mitre link : CVE-2024-10439
CVE.ORG link : CVE-2024-10439
JSON object : View
Products Affected
sun.net
- ehrd_ctms
CWE
CWE-639
Authorization Bypass Through User-Controlled Key