CVE-2024-6737
2100 TECHNOLOGY Electronic Official Document Management System - Broken Access Control
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
2100 TECHNOLOGY Electronic Official Document Management System - Broken Access Control
| Assigner | twcert |
| Reserved | 2024-07-15 |
| Published | 2024-07-15 |
| Updated | 2024-08-01 |
The access control in the Electronic Official Document Management System from 2100 TECHNOLOGY is not properly implemented, allowing remote attackers with regular privileges to access the account settings functionality and create an administrator account.
| CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CWE-284: Improper Access Control
https://www.twcert.org.tw/tw/cp-132-7923-46df3-1.html
https://www.twcert.org.tw/en/cp-139-7924-85606-2.html
