CVE-2024-12014 | THREATINT

Description

Path Traversal and Insecure Direct Object Reference (IDOR) vulnerabilities in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthenticated attacker to access arbitrary files in the document system via manipulation of file paths and object identifiers.

Reserved 2024-12-02 | Published 2024-12-20 | Updated 2024-12-20 | Assigner INCIBE

LOW: 2.0CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Problem types

CWE-20: Improper Input Validation

Product status

Default status

affected

1.3.2

unaffected

1.4.4

unaffected

4.0.4

unaffected

4.1.4

unaffected

5.0.2

unaffected

5.1.2

unaffected

5.2.4

unaffected

5.3.3

unaffected

5.4.1

unaffected

Credits

Pablo Alcarria Lozano finder

References

edgewatch.com/...signaviewer-allow-unauthorized-file-access/

cve.org (CVE-2024-12014)

nvd.nist.gov (CVE-2024-12014)

Download JSON

Support options

Helpdesk Chat, Email, Knowledgebase

Subscribe to our newsletter to learn more about our work.