CVE-2024-6738 - OpenCVE

The tumbnail API of Tronclass from WisdomGarden lacks proper access control, allowing unauthenticated remote attackers to obtain certain specific files by modifying the URL.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Wisdomgarden	Tronclass

Configuration 1 [-]

cpe:2.3:a:wisdomgarden:tronclass:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.twcert.org.tw/en/cp-139-7926-f7914-2.html
https://www.twcert.org.tw/tw/cp-132-7925-97e1c-1.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2024-07-15T02:50:39.639Z

Updated: 2024-08-01T21:41:04.604Z

Reserved: 2024-07-15T02:29:39.882Z

Link: CVE-2024-6738

Vulnrichment

Updated: 2024-08-01T21:41:04.604Z

NVD

Status : Analyzed

Published: 2024-07-15T03:15:03.293

Modified: 2024-07-16T14:06:27.810

Link: CVE-2024-6738

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-6738", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2024-07-15T02:29:39.882Z", "datePublished": "2024-07-15T02:50:39.639Z", "dateUpdated": "2024-08-01T21:41:04.604Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Tronclass", "vendor": "WisdomGarden", "versions": [{"lessThan": "1.69.61976", "status": "affected", "version": "all", "versionType": "custom"}]}], "datePublic": "2024-07-15T02:44:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The tumbnail API of Tronclass from WisdomGarden lacks proper access control, allowing unauthenticated remote attackers to obtain certain specific files by modifying the URL."}], "value": "The tumbnail API of Tronclass from WisdomGarden lacks proper access control, allowing unauthenticated remote attackers to obtain certain specific files by modifying the URL."}], "impacts": [{"capecId": "CAPEC-545", "descriptions": [{"lang": "en", "value": "CAPEC-545 Pull Data from System Resources"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284: Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-07-15T02:50:39.639Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-7925-97e1c-1.html"}, {"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/en/cp-139-7926-f7914-2.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to \n\n<span style=\"background-color: rgb(255, 255, 255);\">version</span> 1.69.61976 or later."}], "value": "Update to \n\nversion\u00a01.69.61976 or later."}], "source": {"advisory": "TVN-202407004", "discovery": "EXTERNAL"}, "title": "WisdomGarden Tronclass - Broken Access Control", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "wisdomgarden", "product": "tronclass_ilearn", "cpes": ["cpe:2.3:a:wisdomgarden:tronclass_ilearn:-:*:*:*:web:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.69.61976", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-16T18:28:36.205111Z", "id": "CVE-2024-6738", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-24T20:13:14.207Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:41:04.604Z"}, "title": "CVE Program Container", "references": [{"tags": ["third-party-advisory", "x_transferred"], "url": "https://www.twcert.org.tw/tw/cp-132-7925-97e1c-1.html"}, {"tags": ["third-party-advisory", "x_transferred"], "url": "https://www.twcert.org.tw/en/cp-139-7926-f7914-2.html"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7925-97e1c-1.html", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://www.twcert.org.tw/en/cp-139-7926-f7914-2.html", "tags": ["third-party-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:41:04.604Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-6738", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-16T18:28:36.205111Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:wisdomgarden:tronclass_ilearn:-:*:*:*:web:*:*:*"], "vendor": "wisdomgarden", "product": "tronclass_ilearn", "versions": [{"status": "affected", "version": "0", "lessThan": "1.69.61976", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-16T18:33:24.553Z"}}], "cna": {"title": "WisdomGarden Tronclass - Broken Access Control", "source": {"advisory": "TVN-202407004", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-545", "descriptions": [{"lang": "en", "value": "CAPEC-545 Pull Data from System Resources"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "WisdomGarden", "product": "Tronclass", "versions": [{"status": "affected", "version": "all", "lessThan": "1.69.61976", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to \n\nversion\u00a01.69.61976 or later.", "supportingMedia": [{"type": "text/html", "value": "Update to \n\n<span style=\"background-color: rgb(255, 255, 255);\">version</span> 1.69.61976 or later.", "base64": false}]}], "datePublic": "2024-07-15T02:44:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7925-97e1c-1.html", "tags": ["third-party-advisory"]}, {"url": "https://www.twcert.org.tw/en/cp-139-7926-f7914-2.html", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The tumbnail API of Tronclass from WisdomGarden lacks proper access control, allowing unauthenticated remote attackers to obtain certain specific files by modifying the URL.", "supportingMedia": [{"type": "text/html", "value": "The tumbnail API of Tronclass from WisdomGarden lacks proper access control, allowing unauthenticated remote attackers to obtain certain specific files by modifying the URL.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-07-15T02:50:39.639Z"}}}, "cveMetadata": {"cveId": "CVE-2024-6738", "state": "PUBLISHED", "dateUpdated": "2024-08-01T21:41:04.604Z", "dateReserved": "2024-07-15T02:29:39.882Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2024-07-15T02:50:39.639Z", "assignerShortName": "twcert"}, "dataVersion": "5.1"}