« Volver al listado

CVE-2024-3774

Estado: AnalizadaMedia (5.3)—

aEnrich Technology a+HRD's functionality for front-end retrieval of system configuration values lacks proper restrictions on a specific parameter, allowing attackers to modify this parameter to access certain sensitive system configuration values.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Aenrich — A+hrd

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-3774",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-3774",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-07T15:19:48.388986Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "twcert@cert.org.tw",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "twcert@cert.org.tw",
      "affectedData": [
        {
          "vendor": "aEnrich Technology",
          "product": "a+HRD",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "status": "affected",
              "version": "7.0",
              "versionType": "custom",
              "lessThanOrEqual": "7.2"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:aenrich:a\\+hrd:*:*:*:*:*:*:*:*"
          ],
          "vendor": "aenrich",
          "product": "a\\+hrd",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "status": "affected",
              "version": "7.0",
              "versionType": "custom",
              "lessThanOrEqual": "7.2"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-04-15T03:16:08.197",
  "references": [
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-7724-c28d3-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "twcert@cert.org.tw"
    },
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-7724-c28d3-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "twcert@cert.org.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        },
        {
          "lang": "en",
          "value": "CWE-497"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "aEnrich Technology a+HRD's functionality for front-end retrieval of system configuration values lacks proper restrictions on a specific parameter, allowing attackers to modify this parameter to access certain sensitive system configuration values."
    },
    {
      "lang": "es",
      "value": "La funcionalidad de aEnrich Technology a+HRD para la recuperación frontal de valores de configuración del sistema carece de restricciones adecuadas en un parámetro específico, lo que permite a los atacantes modificar este parámetro para acceder a ciertos valores de configuración sensibles del sistema."
    }
  ],
  "lastModified": "2026-06-17T07:45:00.010",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:aenrich:a\\+hrd:6.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CFF0E4AE-57D2-4778-8E19-77F585F85EE2"
            },
            {
              "criteria": "cpe:2.3:a:aenrich:a\\+hrd:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E60AA81B-7D96-4771-902A-FACF58130D97"
            },
            {
              "criteria": "cpe:2.3:a:aenrich:a\\+hrd:7.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F2D47A8A-1486-4C86-84D0-6966CB015A79"
            },
            {
              "criteria": "cpe:2.3:a:aenrich:a\\+hrd:7.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AFC4DCEB-8D0A-4836-B7F3-5DD18BBF4441"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "twcert@cert.org.tw"
}