« Volver al listado

CVE-2024-3775

Estado: AnalizadaAlta (7.5)—

aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitrary arguments to youtube-dl.exe, leading to the download of partial unauthorized files.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Aenrich — A+hrd

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-3775",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-3775",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-03T19:41:26.625409Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "twcert@cert.org.tw",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "twcert@cert.org.tw",
      "affectedData": [
        {
          "vendor": "aEnrich Technology",
          "product": "a+HRD",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "status": "affected",
              "version": "7.2"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:aenrich:a\\+hrd:*:*:*:*:*:*:*:*"
          ],
          "vendor": "aenrich",
          "product": "a\\+hrd",
          "versions": [
            {
              "status": "affected",
              "version": "6.8",
              "lessThan": "6.8.1039V1055",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "7.0",
              "lessThan": "7.0.1141V422",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "7.1",
              "lessThan": "7.1.1033V429",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "7.2",
              "lessThan": "7.2.1061V36",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-04-15T04:15:16.137",
  "references": [
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-7726-e5f70-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "twcert@cert.org.tw"
    },
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-7726-e5f70-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "twcert@cert.org.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-88"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitrary arguments to youtube-dl.exe, leading to the download of partial unauthorized files."
    },
    {
      "lang": "es",
      "value": "La funcionalidad de aEnrich Technology a+HRD para descargar archivos usando youtube-dl.exe no restringe adecuadamente la entrada del usuario. Esto permite a los atacantes pasar argumentos arbitrarios a youtube-dl.exe, lo que lleva a la descarga parcial de archivos no autorizados."
    }
  ],
  "lastModified": "2026-06-17T07:45:00.130",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:aenrich:a\\+hrd:6.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CFF0E4AE-57D2-4778-8E19-77F585F85EE2"
            },
            {
              "criteria": "cpe:2.3:a:aenrich:a\\+hrd:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E60AA81B-7D96-4771-902A-FACF58130D97"
            },
            {
              "criteria": "cpe:2.3:a:aenrich:a\\+hrd:7.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F2D47A8A-1486-4C86-84D0-6966CB015A79"
            },
            {
              "criteria": "cpe:2.3:a:aenrich:a\\+hrd:7.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AFC4DCEB-8D0A-4836-B7F3-5DD18BBF4441"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "twcert@cert.org.tw"
}