Summaryinfo

A vulnerability classified as problematic was found in Apiris Kafeo 6.4.4. This vulnerability affects unknown code. The manipulation leads to uncontrolled search path. This vulnerability was named CVE-2024-28060. Local access is required to approach this attack. There is no exploit available. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Detailsinfo

A vulnerability classified as problematic has been found in Apiris Kafeo 6.4.4. This affects an unknown code block. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. CWE is classifying the issue as CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in Apiris Kafeo 6.4.4. It permits DLL hijacking, allowing a user to trigger the execution of arbitrary code every time the product is executed.

The advisory is shared at excellium-services.com. This vulnerability is uniquely identified as CVE-2024-28060 since 03/01/2024. The exploitability is told to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1574 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Apiris

Name

• Kafeo

Version

• 6.4.4

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion