CVE-2024-3775 - Vulnerability Details - OpenCVE

aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitrary arguments to youtube-dl.exe, leading to the download of partial unauthorized files.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00093.

Key SSVC decision points have not yet been added.

Vendors	Products
Aenrich	A\+hrd

Configuration 1 [-]

OR	cpe:2.3:a:aenrich:a\+hrd:6.8:::::::*
	cpe:2.3:a:aenrich:a\+hrd:7.0:::::::*
	cpe:2.3:a:aenrich:a\+hrd:7.1:::::::*
	cpe:2.3:a:aenrich:a\+hrd:7.2:::::::*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2024-32347	aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitrary arguments to youtube-dl.exe, leading to the download of partial unauthorized files.

Fixes

Solution

Update to eHRD 6.8.1039V1055 or later version Update to eHRD 7.0.1141V422 or later version Update to eHRD 7.1.1033V429 or later version Update to eHRD 7.2.1061V36 or later version

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.twcert.org.tw/tw/cp-132-7726-e5f70-1.html

History

Tue, 08 Apr 2025 17:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Aenrich Aenrich a\+hrd
CPEs		cpe:2.3:a:aenrich:a\+hrd:6.8:::::::* cpe:2.3:a:aenrich:a\+hrd:7.0:::::::* cpe:2.3:a:aenrich:a\+hrd:7.1:::::::* cpe:2.3:a:aenrich:a\+hrd:7.2:::::::*
Vendors & Products		Aenrich Aenrich a\+hrd

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2024-04-15T02:41:18.782Z

Updated: 2024-08-01T20:20:01.574Z

Reserved: 2024-04-15T01:56:14.581Z

Link: CVE-2024-3775

Vulnrichment

Updated: 2024-08-01T20:20:01.574Z

NVD

Status : Analyzed

Published: 2024-04-15T04:15:16.137

Modified: 2025-04-08T16:30:51.500

Link: CVE-2024-3775

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-3775", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2024-04-15T01:56:14.581Z", "datePublished": "2024-04-15T02:41:18.782Z", "dateUpdated": "2024-08-01T20:20:01.574Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "a+HRD", "vendor": "aEnrich Technology", "versions": [{"status": "affected", "version": "6.8"}, {"status": "affected", "version": "7.0"}, {"status": "affected", "version": "7.1"}, {"status": "affected", "version": "7.2"}]}], "datePublic": "2024-04-15T02:45:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitrary arguments to youtube-dl.exe, leading to the download of partial unauthorized files."}], "value": "aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitrary arguments to youtube-dl.exe, leading to the download of partial unauthorized files."}], "impacts": [{"capecId": "CAPEC-6", "descriptions": [{"lang": "en", "value": "CAPEC-6 Argument Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-88", "description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-04-15T02:50:03.220Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-7726-e5f70-1.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to eHRD 6.8.1039V1055 or later version<br>Update to eHRD 7.0.1141V422 or later version<br>Update to eHRD 7.1.1033V429 or later version<br>Update to eHRD 7.2.1061V36 or later version"}], "value": "Update to eHRD 6.8.1039V1055 or later version\nUpdate to eHRD 7.0.1141V422 or later version\nUpdate to eHRD 7.1.1033V429 or later version\nUpdate to eHRD 7.2.1061V36 or later version"}], "source": {"advisory": "TVN-202404003", "discovery": "EXTERNAL"}, "title": "aEnrich Technology a+HRD - Argument Injection", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "aenrich", "product": "a\\+hrd", "cpes": ["cpe:2.3:a:aenrich:a\\+hrd:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "6.8", "status": "affected", "lessThan": "6.8.1039V1055", "versionType": "custom"}, {"version": "7.0", "status": "affected", "lessThan": "7.0.1141V422", "versionType": "custom"}, {"version": "7.1", "status": "affected", "lessThan": "7.1.1033V429", "versionType": "custom"}, {"version": "7.2", "status": "affected", "lessThan": "7.2.1061V36", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-03T19:41:26.625409Z", "id": "CVE-2024-3775", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T12:48:08.114Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:20:01.574Z"}, "title": "CVE Program Container", "references": [{"tags": ["third-party-advisory", "x_transferred"], "url": "https://www.twcert.org.tw/tw/cp-132-7726-e5f70-1.html"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7726-e5f70-1.html", "tags": ["third-party-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:20:01.574Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-3775", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-03T19:41:26.625409Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:aenrich:a\\+hrd:*:*:*:*:*:*:*:*"], "vendor": "aenrich", "product": "a\\+hrd", "versions": [{"status": "affected", "version": "6.8", "lessThan": "6.8.1039V1055", "versionType": "custom"}, {"status": "affected", "version": "7.0", "lessThan": "7.0.1141V422", "versionType": "custom"}, {"status": "affected", "version": "7.1", "lessThan": "7.1.1033V429", "versionType": "custom"}, {"status": "affected", "version": "7.2", "lessThan": "7.2.1061V36", "versionType": "custom"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-03T19:46:43.503Z"}}], "cna": {"title": "aEnrich Technology a+HRD - Argument Injection", "source": {"advisory": "TVN-202404003", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-6", "descriptions": [{"lang": "en", "value": "CAPEC-6 Argument Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "aEnrich Technology", "product": "a+HRD", "versions": [{"status": "affected", "version": "6.8"}, {"status": "affected", "version": "7.0"}, {"status": "affected", "version": "7.1"}, {"status": "affected", "version": "7.2"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to eHRD 6.8.1039V1055 or later version\nUpdate to eHRD 7.0.1141V422 or later version\nUpdate to eHRD 7.1.1033V429 or later version\nUpdate to eHRD 7.2.1061V36 or later version", "supportingMedia": [{"type": "text/html", "value": "Update to eHRD 6.8.1039V1055 or later version<br>Update to eHRD 7.0.1141V422 or later version<br>Update to eHRD 7.1.1033V429 or later version<br>Update to eHRD 7.2.1061V36 or later version", "base64": false}]}], "datePublic": "2024-04-15T02:45:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7726-e5f70-1.html", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitrary arguments to youtube-dl.exe, leading to the download of partial unauthorized files.", "supportingMedia": [{"type": "text/html", "value": "aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitrary arguments to youtube-dl.exe, leading to the download of partial unauthorized files.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-88", "description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-04-15T02:50:03.220Z"}}}, "cveMetadata": {"cveId": "CVE-2024-3775", "state": "PUBLISHED", "dateUpdated": "2024-08-01T20:20:01.574Z", "dateReserved": "2024-04-15T01:56:14.581Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2024-04-15T02:41:18.782Z", "assignerShortName": "twcert"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:aenrich:a\\+hrd:6.8:*:*:*:*:*:*:*", "matchCriteriaId": "CFF0E4AE-57D2-4778-8E19-77F585F85EE2", "vulnerable": true}, {"criteria": "cpe:2.3:a:aenrich:a\\+hrd:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "E60AA81B-7D96-4771-902A-FACF58130D97", "vulnerable": true}, {"criteria": "cpe:2.3:a:aenrich:a\\+hrd:7.1:*:*:*:*:*:*:*", "matchCriteriaId": "F2D47A8A-1486-4C86-84D0-6966CB015A79", "vulnerable": true}, {"criteria": "cpe:2.3:a:aenrich:a\\+hrd:7.2:*:*:*:*:*:*:*", "matchCriteriaId": "AFC4DCEB-8D0A-4836-B7F3-5DD18BBF4441", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitrary arguments to youtube-dl.exe, leading to the download of partial unauthorized files."}, {"lang": "es", "value": "La funcionalidad de aEnrich Technology a+HRD para descargar archivos usando youtube-dl.exe no restringe adecuadamente la entrada del usuario. Esto permite a los atacantes pasar argumentos arbitrarios a youtube-dl.exe, lo que lleva a la descarga parcial de archivos no autorizados."}], "id": "CVE-2024-3775", "lastModified": "2025-04-08T16:30:51.500", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "twcert@cert.org.tw", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-04-15T04:15:16.137", "references": [{"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-7726-e5f70-1.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-7726-e5f70-1.html"}], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-88"}], "source": "twcert@cert.org.tw", "type": "Secondary"}]}