CVE-2024-6738 - Vulnerability Details - OpenCVE

The tumbnail API of Tronclass from WisdomGarden lacks proper access control, allowing unauthenticated remote attackers to obtain certain specific files by modifying the URL.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00121.

Key SSVC decision points have not yet been added.

Vendors	Products
Wisdomgarden	Tronclass

Configuration 1 [-]

cpe:2.3:a:wisdomgarden:tronclass:*:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

Update to version 1.69.61976 or later.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.twcert.org.tw/en/cp-139-7926-f7914-2.html
https://www.twcert.org.tw/tw/cp-132-7925-97e1c-1.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2024-07-15T02:50:39.639Z

Updated: 2024-08-01T21:41:04.604Z

Reserved: 2024-07-15T02:29:39.882Z

Link: CVE-2024-6738

Vulnrichment

Updated: 2024-08-01T21:41:04.604Z

NVD

Status : Modified

Published: 2024-07-15T03:15:03.293

Modified: 2024-11-21T09:50:13.097

Link: CVE-2024-6738

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-6738", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2024-07-15T02:29:39.882Z", "datePublished": "2024-07-15T02:50:39.639Z", "dateUpdated": "2024-08-01T21:41:04.604Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Tronclass", "vendor": "WisdomGarden", "versions": [{"lessThan": "1.69.61976", "status": "affected", "version": "all", "versionType": "custom"}]}], "datePublic": "2024-07-15T02:44:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The tumbnail API of Tronclass from WisdomGarden lacks proper access control, allowing unauthenticated remote attackers to obtain certain specific files by modifying the URL."}], "value": "The tumbnail API of Tronclass from WisdomGarden lacks proper access control, allowing unauthenticated remote attackers to obtain certain specific files by modifying the URL."}], "impacts": [{"capecId": "CAPEC-545", "descriptions": [{"lang": "en", "value": "CAPEC-545 Pull Data from System Resources"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284: Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-07-15T02:50:39.639Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-7925-97e1c-1.html"}, {"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/en/cp-139-7926-f7914-2.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to \n\n<span style=\"background-color: rgb(255, 255, 255);\">version</span> 1.69.61976 or later."}], "value": "Update to \n\nversion\u00a01.69.61976 or later."}], "source": {"advisory": "TVN-202407004", "discovery": "EXTERNAL"}, "title": "WisdomGarden Tronclass - Broken Access Control", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "wisdomgarden", "product": "tronclass_ilearn", "cpes": ["cpe:2.3:a:wisdomgarden:tronclass_ilearn:-:*:*:*:web:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.69.61976", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-16T18:28:36.205111Z", "id": "CVE-2024-6738", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-24T20:13:14.207Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:41:04.604Z"}, "title": "CVE Program Container", "references": [{"tags": ["third-party-advisory", "x_transferred"], "url": "https://www.twcert.org.tw/tw/cp-132-7925-97e1c-1.html"}, {"tags": ["third-party-advisory", "x_transferred"], "url": "https://www.twcert.org.tw/en/cp-139-7926-f7914-2.html"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7925-97e1c-1.html", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://www.twcert.org.tw/en/cp-139-7926-f7914-2.html", "tags": ["third-party-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:41:04.604Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-6738", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-16T18:28:36.205111Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:wisdomgarden:tronclass_ilearn:-:*:*:*:web:*:*:*"], "vendor": "wisdomgarden", "product": "tronclass_ilearn", "versions": [{"status": "affected", "version": "0", "lessThan": "1.69.61976", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-16T18:33:24.553Z"}}], "cna": {"title": "WisdomGarden Tronclass - Broken Access Control", "source": {"advisory": "TVN-202407004", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-545", "descriptions": [{"lang": "en", "value": "CAPEC-545 Pull Data from System Resources"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "WisdomGarden", "product": "Tronclass", "versions": [{"status": "affected", "version": "all", "lessThan": "1.69.61976", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to \n\nversion\u00a01.69.61976 or later.", "supportingMedia": [{"type": "text/html", "value": "Update to \n\n<span style=\"background-color: rgb(255, 255, 255);\">version</span> 1.69.61976 or later.", "base64": false}]}], "datePublic": "2024-07-15T02:44:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7925-97e1c-1.html", "tags": ["third-party-advisory"]}, {"url": "https://www.twcert.org.tw/en/cp-139-7926-f7914-2.html", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The tumbnail API of Tronclass from WisdomGarden lacks proper access control, allowing unauthenticated remote attackers to obtain certain specific files by modifying the URL.", "supportingMedia": [{"type": "text/html", "value": "The tumbnail API of Tronclass from WisdomGarden lacks proper access control, allowing unauthenticated remote attackers to obtain certain specific files by modifying the URL.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-07-15T02:50:39.639Z"}}}, "cveMetadata": {"cveId": "CVE-2024-6738", "state": "PUBLISHED", "dateUpdated": "2024-08-01T21:41:04.604Z", "dateReserved": "2024-07-15T02:29:39.882Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2024-07-15T02:50:39.639Z", "assignerShortName": "twcert"}, "dataVersion": "5.1"}