CVE-2024-26261

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26261
The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability. Attackers can put file path in specific request parameters, allowing them to download the file without login. Furthermore, the file will be deleted after being downloaded.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96 Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-7674-bdb40-1.html Third Party Advisory
https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96 Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-7674-bdb40-1.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:hgiga:oaklouds-organization-2.0:*:*:*:*:*:*:*:*
cpe:2.3:a:hgiga:oaklouds-organization-3.0:*:*:*:*:*:*:*:*
cpe:2.3:a:hgiga:oaklouds-webbase-2.0:*:*:*:*:*:*:*:*
cpe:2.3:a:hgiga:oaklouds-webbase-3.0:*:*:*:*:*:*:*:*
History

23 Jan 2025, 19:56

Type Values Removed Values Added
CPE cpe:2.3:a:hgiga:oaklouds-webbase-2.0:*:*:*:*:*:*:*:*
cpe:2.3:a:hgiga:oaklouds-organization-3.0:*:*:*:*:*:*:*:*
cpe:2.3:a:hgiga:oaklouds-organization-2.0:*:*:*:*:*:*:*:*
cpe:2.3:a:hgiga:oaklouds-webbase-3.0:*:*:*:*:*:*:*:*
References () https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96 - () https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96 - Third Party Advisory
References () https://www.twcert.org.tw/tw/cp-132-7674-bdb40-1.html - () https://www.twcert.org.tw/tw/cp-132-7674-bdb40-1.html - Third Party Advisory
First Time Hgiga
Hgiga oaklouds-organization-3.0
Hgiga oaklouds-organization-2.0
Hgiga oaklouds-webbase-3.0
Hgiga oaklouds-webbase-2.0

21 Nov 2024, 09:02

Type Values Removed Values Added
References () https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96 - () https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96 -
References () https://www.twcert.org.tw/tw/cp-132-7674-bdb40-1.html - () https://www.twcert.org.tw/tw/cp-132-7674-bdb40-1.html -

28 Jun 2024, 02:15

Type Values Removed Values Added
References
  • () https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96 -
Summary
  • (es) La funcionalidad para descargar archivos en ciertos módulos de HGiga OAKlouds contiene una vulnerabilidad de lectura y eliminación arbitraria de archivos. Los atacantes pueden poner la ruta del archivo en parámetros de solicitud específicos, lo que les permite descargar el archivo sin iniciar sesión. Además, el archivo se eliminará después de descargarlo.

15 Feb 2024, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-15 03:15

Updated : 2025-01-23 19:56

NVD link : CVE-2024-26261

Mitre link : CVE-2024-26261

CVE.ORG link : CVE-2024-26261

JSON object : View

Products Affected

hgiga

  • oaklouds-organization-3.0
  • oaklouds-organization-2.0
  • oaklouds-webbase-3.0
  • oaklouds-webbase-2.0
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')