Critical severity · published Feb 15, 2024
CVE-2024-26261
The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability. Attackers can put file path in specific request parameters, allowing them to download the file without login. Furthermore, the file will be deleted after being downloaded.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OA
Oaklouds-organization-2.0 · Hgiga
before 188 · source: NVD
OA
Oaklouds-organization-3.0 · Hgiga
before 188 · source: NVD
OA
Oaklouds-webbase-2.0 · Hgiga
before 1051 · source: NVD
OA
Oaklouds-webbase-3.0 · Hgiga
before 1051 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-26261
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-26261
Third Party Advisory
https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96
Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-7674-bdb40-1.html
More from Oaklouds-organization-2.0
9.8
CVE-2024-26260
The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within…