CVE-2024-9984

critical

Description

Enterprise Cloud Database from Ragic does not authenticate access to specific functionality, allowing unauthenticated remote attackers to use this functionality to obtain any user's session cookie.

References

Advisories

https://www.twcert.org.tw/tw/cp-132-8150-c955a-1.html

https://www.twcert.org.tw/en/cp-139-8151-1a4b5-2.html

Details

Source: Mitre, NVD

Published: 2024-10-15

Updated: 2024-10-16

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H