EpointWebBuilder 5.1.0-sp1/5.2.1-sp1/5.4.1/5.4.2 URL infoid parameters

Summaryinfo

A vulnerability marked as critical has been reported in EpointWebBuilder 5.1.0-sp1/5.2.1-sp1/5.4.1/5.4.2. This impacts an unknown function of the component URL Handler. Performing a manipulation of the argument infoid results in an unknown weakness. This vulnerability is identified as CVE-2024-24525. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical has been found in EpointWebBuilder 5.1.0-sp1/5.2.1-sp1/5.4.1/5.4.2. This affects an unknown code of the component URL Handler. The manipulation of the argument infoid with an unknown input leads to a unknown weakness. CWE is classifying the issue as CWE-233. The product does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An issue in EpointWebBuilder 5.1.0-sp1, 5.2.1-sp1, 5.4.1 and 5.4.2 allows a remote attacker to execute arbitrary code via the infoid parameter of the URL.

The weakness was released 02/29/2024. It is possible to read the advisory at l3v3lforall.github.io. This vulnerability is uniquely identified as CVE-2024-24525 since 01/25/2024. Technical details of the vulnerability are known, but there is no available exploit.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• EpointWebBuilder

Version

• 5.1.0-sp1
• 5.2.1-sp1
• 5.4.1
• 5.4.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion