CVE-2024-37728

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-37728
Arbitrary File Read vulnerability in Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7.18.23.0 and v8.6.1.0 allows a remote attacker to obtain sensitive information via the "Pic/Indexes" interface

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/wy876/POC/blob/main/OfficeWeb365/OfficeWeb365_%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md
https://github.com/xuetang1125/OfficeWeb365/blob/main/OfficeWeb365_%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%20.md
Configurations

No configuration.

History

11 Sep 2024, 15:15

Type Values Removed Values Added
References
  • {'url': 'https://ti.qianxin.com/vulnerability/notice-list?value=officeweb365', 'source': 'cve@mitre.org'}
  • {'url': 'https://www.cnnvd.org.cn/home/warn', 'source': 'cve@mitre.org'}

10 Sep 2024, 16:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CWE CWE-922
CWE-22
Summary
  • (es) La vulnerabilidad de lectura arbitraria de archivos en Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7.18.23.0 y v8.6.1.0 permite a un atacante remoto obtener información confidencial a través de la interfaz "Pic/Indexes"

10 Sep 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-10 14:15

Updated : 2024-09-11 15:15

NVD link : CVE-2024-37728

Mitre link : CVE-2024-37728

CVE.ORG link : CVE-2024-37728

JSON object : View

Products Affected

No product.

CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-922

Insecure Storage of Sensitive Information