Log in Start free

Vulnerability · Published Dec 31, 2024 · Assigned by twcert

CVE-2024-130612100 Technology Electronic Official Document Management System - Authentication Bypass

Critical 9.8

In plain English

A critical-severity authentication bypass by spoofing in Official Document Management System from 2100 Technology Electronic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.3%top 29.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The Electronic Official Document Management System from 2100 Technology has an Authentication Bypass vulnerability. Although the product enforces an IP whitelist for the API used to query user tokens, unauthenticated remote attackers can still deceive the server to obtain tokens of arbitrary users, which can then be used to log into the system.

Affected products (as reported)

VendorProductVersions
2100 Technology Electronic Official Document Management System 0 – before 5.0.86.9

Weakness: CWE-290 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References