CVE-2024-9922 - Vulnerability Details - OpenCVE

The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00405.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Teamplus	Team\+ Team\+ Pro

Configuration 1 [-]

cpe:2.3:a:teamplus:team\+_pro:*:*:*:*:private_cloud:android:*:*

No data.

No data.

References

Link	Providers
https://www.twcert.org.tw/en/cp-139-8127-41699-2.html
https://www.twcert.org.tw/tw/cp-132-8126-5d9d2-1.html

History

Thu, 24 Oct 2024 13:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Teamplus team\+ Pro
Weaknesses		NVD-CWE-Other
CPEs		cpe:2.3:a:teamplus:team\+_pro:::::private_cloud:android::
Vendors & Products		Teamplus team\+ Pro

Tue, 15 Oct 2024 19:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Teamplus Teamplus team\+
CPEs		cpe:2.3:a:teamplus:team\+::::::::
Vendors & Products		Teamplus Teamplus team\+
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 14 Oct 2024 03:15:00 +0000

Type	Values Removed	Values Added
Description		The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.
Title		TEAMPLUS TECHNOLOGY Team+ - Arbitrary File Read through Path Traversal
Weaknesses		CWE-23
References		https://www.twcert.org.tw/en/cp-139-8127-41699-2.html https://www.twcert.org.tw/tw/cp-132-8126-5d9d2-1.html
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2024-10-14T02:55:01.325Z

Updated: 2024-10-15T18:20:33.844Z

Reserved: 2024-10-14T02:10:15.245Z

Link: CVE-2024-9922

Vulnrichment

Updated: 2024-10-15T18:20:26.988Z

NVD

Status : Analyzed

Published: 2024-10-14T03:15:10.683

Modified: 2024-10-24T13:21:53.853

Link: CVE-2024-9922

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-9922", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2024-10-14T02:10:15.245Z", "datePublished": "2024-10-14T02:55:01.325Z", "dateUpdated": "2024-10-15T18:20:33.844Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "team+", "vendor": "teamplus technology", "versions": [{"status": "affected", "version": "13.5.*"}]}], "datePublic": "2024-10-14T02:52:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.</span>"}], "value": "The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files."}], "impacts": [{"capecId": "CAPEC-139", "descriptions": [{"lang": "en", "value": "CAPEC-139 Relative Path Traversal"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-23", "description": "CWE-23 Relative Path Traversal", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-10-14T02:55:01.325Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-8126-5d9d2-1.html"}, {"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/en/cp-139-8127-41699-2.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "  Update to version v14.0.0 or later."}], "value": "Update to version v14.0.0 or later."}], "source": {"advisory": "TVN-202410002", "discovery": "EXTERNAL"}, "title": "TEAMPLUS TECHNOLOGY Team+ - Arbitrary File Read through Path Traversal", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "teamplus", "product": "team\\+", "cpes": ["cpe:2.3:a:teamplus:team\\+:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "13.5", "status": "affected", "lessThan": "14.0.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-15T18:16:59.739592Z", "id": "CVE-2024-9922", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-15T18:20:33.844Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-9922", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-15T18:16:59.739592Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:teamplus:team\\+:*:*:*:*:*:*:*:*"], "vendor": "teamplus", "product": "team\\+", "versions": [{"status": "affected", "version": "13.5", "lessThan": "14.0.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-15T18:20:26.988Z"}}], "cna": {"title": "TEAMPLUS TECHNOLOGY Team+ - Arbitrary File Read through Path Traversal", "source": {"advisory": "TVN-202410002", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-139", "descriptions": [{"lang": "en", "value": "CAPEC-139 Relative Path Traversal"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "teamplus technology", "product": "team+", "versions": [{"status": "affected", "version": "13.5.*"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to version v14.0.0 or later.", "supportingMedia": [{"type": "text/html", "value": "  Update to version v14.0.0 or later.", "base64": false}]}], "datePublic": "2024-10-14T02:52:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-8126-5d9d2-1.html", "tags": ["third-party-advisory"]}, {"url": "https://www.twcert.org.tw/en/cp-139-8127-41699-2.html", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-23", "description": "CWE-23 Relative Path Traversal"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-10-14T02:55:01.325Z"}}}, "cveMetadata": {"cveId": "CVE-2024-9922", "state": "PUBLISHED", "dateUpdated": "2024-10-15T18:20:33.844Z", "dateReserved": "2024-10-14T02:10:15.245Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2024-10-14T02:55:01.325Z", "assignerShortName": "twcert"}, "dataVersion": "5.1"}