CVE-2024-7098 - Vulnerability Details

Vendors	Products
Sfs	Winsure
Sfs Consulting	Wwwinsure

Link	Providers
https://www.usom.gov.tr/bildirim/tr-24-1475

Type	Values Removed	Values Added
First Time appeared		Sfs Sfs winsure
CPEs		cpe:2.3:a:sfs:winsure::::::::
Vendors & Products		Sfs Sfs winsure
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Type	Values Removed	Values Added
First Time appeared		Sfs Consulting Sfs Consulting wwwinsure
CPEs		cpe:2.3:a:sfs_consulting:wwwinsure::::::::
Vendors & Products		Sfs Consulting Sfs Consulting wwwinsure
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection.This issue affects ww.Winsure: before 4.6.2.
Title		XML Injection in SFS Consulting's ww.Winsure
Weaknesses		CWE-611
References		https://www.usom.gov.tr/bildirim/tr-24-1475
Metrics		cvssV4_0 `{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-7098", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2024-07-25T08:59:09.708Z", "datePublished": "2024-09-16T14:50:42.192Z", "dateUpdated": "2024-09-17T10:55:54.015Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ww.Winsure", "vendor": "SFS Consulting", "versions": [{"lessThan": "4.6.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Kaan ATMACA"}, {"lang": "en", "type": "finder", "value": "Berk \u0130MRAN"}, {"lang": "en", "type": "sponsor", "value": "Secure Future Inc."}, {"lang": "en", "type": "finder", "value": "Salih \u00d6ZEK"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection.<p>This issue affects ww.Winsure: before 4.6.2.</p>"}], "value": "Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection.This issue affects ww.Winsure: before 4.6.2."}], "impacts": [{"capecId": "CAPEC-250", "descriptions": [{"lang": "en", "value": "CAPEC-250 XML Injection"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.2, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2024-09-17T10:55:54.015Z"}, "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-24-1475"}], "source": {"advisory": "TR-24-1475", "defect": ["TR-24-1475"], "discovery": "UNKNOWN"}, "title": "XML Injection in SFS Consulting's ww.Winsure", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "sfs_consulting", "product": "wwwinsure", "cpes": ["cpe:2.3:a:sfs_consulting:wwwinsure:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "4.6.2", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-16T16:28:47.349766Z", "id": "CVE-2024-7098", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-16T16:30:21.853Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-7098 (string)

assignerOrgId : ca940d4e-fea4-4aa2-9a58-591a58b1ce21 (string)

state : PUBLISHED (string)

assignerShortName : TR-CERT (string)

dateReserved : 2024-07-25T08:59:09.708Z (string)

datePublished : 2024-09-16T14:50:42.192Z (string)

dateUpdated : 2024-09-17T10:55:54.015Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : ww.Winsure (string)

vendor : SFS Consulting (string)

versions : [ »

0 : { »

lessThan : 4.6.2 (string)

status : affected (string)

version : 0 (string)

versionType : custom (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Kaan ATMACA (string)

}

1 : { »

lang : en (string)

type : finder (string)

value : Berk İMRAN (string)

}

2 : { »

lang : en (string)

type : sponsor (string)

value : Secure Future Inc. (string)

}

3 : { »

lang : en (string)

type : finder (string)

value : Salih ÖZEK (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection.<p>This issue affects ww.Winsure: before 4.6.2.</p> (string)

}

]

value : Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection.This issue affects ww.Winsure: before 4.6.2. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-250 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-250 XML Injection (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV4_0 : { »

Automatable : NOT_DEFINED (string)

Recovery : NOT_DEFINED (string)

Safety : NOT_DEFINED (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

attackVector : NETWORK (string)

baseScore : 9.2 (number)

baseSeverity : CRITICAL (string)

privilegesRequired : NONE (string)

providerUrgency : NOT_DEFINED (string)

subAvailabilityImpact : NONE (string)

subConfidentialityImpact : HIGH (string)

subIntegrityImpact : NONE (string)

userInteraction : NONE (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N (string)

version : 4.0 (string)

vulnAvailabilityImpact : LOW (string)

vulnConfidentialityImpact : HIGH (string)

vulnIntegrityImpact : NONE (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-611 (string)

description : CWE-611 Improper Restriction of XML External Entity Reference (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : ca940d4e-fea4-4aa2-9a58-591a58b1ce21 (string)

shortName : TR-CERT (string)

dateUpdated : 2024-09-17T10:55:54.015Z (string)

}

references : [ »

0 : { »

url : https://www.usom.gov.tr/bildirim/tr-24-1475 (string)

}

]

source : { »

advisory : TR-24-1475 (string)

defect : [ »

0 : TR-24-1475 (string)

]

discovery : UNKNOWN (string)

}

title : XML Injection in SFS Consulting's ww.Winsure (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

affected : [ »

0 : { »

vendor : sfs_consulting (string)

product : wwwinsure (string)

cpes : [ »

0 : cpe:2.3:a:sfs_consulting:wwwinsure:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThan : 4.6.2 (string)

versionType : custom (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-09-16T16:28:47.349766Z (string)

id : CVE-2024-7098 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-16T16:30:21.853Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-7098", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-16T16:28:47.349766Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:sfs_consulting:wwwinsure:*:*:*:*:*:*:*:*"], "vendor": "sfs_consulting", "product": "wwwinsure", "versions": [{"status": "affected", "version": "0", "lessThan": "4.6.2", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-16T16:30:14.310Z"}}], "cna": {"title": "XML Injection in SFS Consulting's ww.Winsure", "source": {"defect": ["TR-24-1475"], "advisory": "TR-24-1475", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Kaan ATMACA"}, {"lang": "en", "type": "finder", "value": "Berk \u0130MRAN"}, {"lang": "en", "type": "sponsor", "value": "Secure Future Inc."}, {"lang": "en", "type": "finder", "value": "Salih \u00d6ZEK"}], "impacts": [{"capecId": "CAPEC-250", "descriptions": [{"lang": "en", "value": "CAPEC-250 XML Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SFS Consulting", "product": "ww.Winsure", "versions": [{"status": "affected", "version": "0", "lessThan": "4.6.2", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-24-1475"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection.This issue affects ww.Winsure: before 4.6.2.", "supportingMedia": [{"type": "text/html", "value": "Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection.<p>This issue affects ww.Winsure: before 4.6.2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2024-09-17T10:55:54.015Z"}}}, "cveMetadata": {"cveId": "CVE-2024-7098", "state": "PUBLISHED", "dateUpdated": "2024-09-17T10:55:54.015Z", "dateReserved": "2024-07-25T08:59:09.708Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2024-09-16T14:50:42.192Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-7098 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-09-16T16:28:47.349766Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:sfs_consulting:wwwinsure:*:*:*:*:*:*:*:* (string)

]

vendor : sfs_consulting (string)

product : wwwinsure (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

lessThan : 4.6.2 (string)

versionType : custom (string)

}

]

defaultStatus : unknown (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-16T16:30:14.310Z (string)

}

]

cna : { »

title : XML Injection in SFS Consulting's ww.Winsure (string)

source : { »

defect : [ »

0 : TR-24-1475 (string)

]

advisory : TR-24-1475 (string)

discovery : UNKNOWN (string)

}

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Kaan ATMACA (string)

}

1 : { »

lang : en (string)

type : finder (string)

value : Berk İMRAN (string)

}

2 : { »

lang : en (string)

type : sponsor (string)

value : Secure Future Inc. (string)

}

3 : { »

lang : en (string)

type : finder (string)

value : Salih ÖZEK (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-250 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-250 XML Injection (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV4_0 : { »

Safety : NOT_DEFINED (string)

version : 4.0 (string)

Recovery : NOT_DEFINED (string)

baseScore : 9.2 (number)

Automatable : NOT_DEFINED (string)

attackVector : NETWORK (string)

baseSeverity : CRITICAL (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N (string)

providerUrgency : NOT_DEFINED (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

privilegesRequired : NONE (string)

subIntegrityImpact : NONE (string)

vulnIntegrityImpact : NONE (string)

subAvailabilityImpact : NONE (string)

vulnAvailabilityImpact : LOW (string)

subConfidentialityImpact : HIGH (string)

vulnConfidentialityImpact : HIGH (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : SFS Consulting (string)

product : ww.Winsure (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

lessThan : 4.6.2 (string)

versionType : custom (string)

}

]

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://www.usom.gov.tr/bildirim/tr-24-1475 (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection.This issue affects ww.Winsure: before 4.6.2. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection.<p>This issue affects ww.Winsure: before 4.6.2.</p> (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-611 (string)

description : CWE-611 Improper Restriction of XML External Entity Reference (string)

}

]

}

]

providerMetadata : { »

orgId : ca940d4e-fea4-4aa2-9a58-591a58b1ce21 (string)

shortName : TR-CERT (string)

dateUpdated : 2024-09-17T10:55:54.015Z (string)

}

cveMetadata : { »

cveId : CVE-2024-7098 (string)

state : PUBLISHED (string)

dateUpdated : 2024-09-17T10:55:54.015Z (string)

dateReserved : 2024-07-25T08:59:09.708Z (string)

assignerOrgId : ca940d4e-fea4-4aa2-9a58-591a58b1ce21 (string)

datePublished : 2024-09-16T14:50:42.192Z (string)

assignerShortName : TR-CERT (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sfs:winsure:*:*:*:*:*:*:*:*", "matchCriteriaId": "FDA3D2E1-4829-46AF-9024-D9CCC53ACF4F", "versionEndExcluding": "4.6.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection.This issue affects ww.Winsure: before 4.6.2."}, {"lang": "es", "value": "La vulnerabilidad de restricci\u00f3n incorrecta de referencia de entidad externa XML en SFS Consulting ww.Winsure permite la inyecci\u00f3n XML. Este problema afecta a ww.Winsure: antes de 4.6.2."}], "id": "CVE-2024-7098", "lastModified": "2024-09-20T17:14:53.063", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "automatable": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "recovery": "NOT_DEFINED", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "subsequentSystemConfidentiality": "HIGH", "subsequentSystemIntegrity": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnerabilityResponseEffort": "NOT_DEFINED", "vulnerableSystemAvailability": "LOW", "vulnerableSystemConfidentiality": "HIGH", "vulnerableSystemIntegrity": "NONE"}, "source": "iletisim@usom.gov.tr", "type": "Secondary"}]}, "published": "2024-09-16T15:15:17.223", "references": [{"source": "iletisim@usom.gov.tr", "tags": ["Broken Link", "Third Party Advisory"], "url": "https://www.usom.gov.tr/bildirim/tr-24-1475"}], "sourceIdentifier": "iletisim@usom.gov.tr", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "iletisim@usom.gov.tr", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:sfs:winsure:*:*:*:*:*:*:*:* (string)

matchCriteriaId : FDA3D2E1-4829-46AF-9024-D9CCC53ACF4F (string)

versionEndExcluding : 4.6.2 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection.This issue affects ww.Winsure: before 4.6.2. (string)

}

1 : { »

lang : es (string)

value : La vulnerabilidad de restricción incorrecta de referencia de entidad externa XML en SFS Consulting ww.Winsure permite la inyección XML. Este problema afecta a ww.Winsure: antes de 4.6.2. (string)

}

]

id : CVE-2024-7098 (string)

lastModified : 2024-09-20T17:14:53.063 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

cvssMetricV40 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackRequirements : NONE (string)

attackVector : NETWORK (string)

automatable : NOT_DEFINED (string)

availabilityRequirements : NOT_DEFINED (string)

baseScore : 9.2 (number)

baseSeverity : CRITICAL (string)

confidentialityRequirements : NOT_DEFINED (string)

exploitMaturity : NOT_DEFINED (string)

integrityRequirements : NOT_DEFINED (string)

modifiedAttackComplexity : NOT_DEFINED (string)

modifiedAttackRequirements : NOT_DEFINED (string)

modifiedAttackVector : NOT_DEFINED (string)

modifiedPrivilegesRequired : NOT_DEFINED (string)

modifiedSubsequentSystemAvailability : NOT_DEFINED (string)

modifiedSubsequentSystemConfidentiality : NOT_DEFINED (string)

modifiedSubsequentSystemIntegrity : NOT_DEFINED (string)

modifiedUserInteraction : NOT_DEFINED (string)

modifiedVulnerableSystemAvailability : NOT_DEFINED (string)

modifiedVulnerableSystemConfidentiality : NOT_DEFINED (string)

modifiedVulnerableSystemIntegrity : NOT_DEFINED (string)

privilegesRequired : NONE (string)

providerUrgency : NOT_DEFINED (string)

recovery : NOT_DEFINED (string)

safety : NOT_DEFINED (string)

subsequentSystemAvailability : NONE (string)

subsequentSystemConfidentiality : HIGH (string)

subsequentSystemIntegrity : NONE (string)

userInteraction : NONE (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (string)

version : 4.0 (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

vulnerableSystemAvailability : LOW (string)

vulnerableSystemConfidentiality : HIGH (string)

vulnerableSystemIntegrity : NONE (string)

}

source : iletisim@usom.gov.tr (string)

type : Secondary (string)

}

]

}

published : 2024-09-16T15:15:17.223 (string)

references : [ »

0 : { »

source : iletisim@usom.gov.tr (string)

tags : [ »

0 : Broken Link (string)

1 : Third Party Advisory (string)

]

url : https://www.usom.gov.tr/bildirim/tr-24-1475 (string)

}

]

sourceIdentifier : iletisim@usom.gov.tr (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-611 (string)

}

]

source : iletisim@usom.gov.tr (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object