Vulnerability · Published Aug 14, 2024 · Assigned by DIVD
CVE-2024-27120Local File Inclusion in ComfortKey before version 24.1.2
High 7.7
In plain English
A high-severity information exposure in ComfortKey from Celsius Benelux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Severity (CVSS 4.0)7.7High
Exploit odds (30 days)0.5%top 53.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A Local File Inclusion vulnerability has been found in ComfortKey, a product of Celsius Benelux. Using this vulnerability, an unauthenticated attacker may retrieve sensitive information about the underlying system. The vulnerability has been remediated in version 24.1.2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Celsius Benelux | ComfortKey | before 24.1.2 |
Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/S:P/AU:Y/R:U/V:C/RE:M/U:Red
References
- https://csirt.divd.nl/CVE-2024-27120 third-party-advisory
- https://csirt.divd.nl/DIVD-2024-00031/ third-party-advisory