Vulnerability · Published Apr 29, 2024 · Assigned by twcert

CVE-2024-4300E-WEBInformationCo. FS-EZViewer(Web) - Sensitive Data Exposure

Critical 9.8

In plain English

A critical-severity information exposure in FS-EZViewer(Web) from E-WEBInformationCo.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.8%top 42.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

E-WEBInformationCo. FS-EZViewer(Web) exposes sensitive information in the service. A remote attacker can obtain the database configuration file path through the webpage source code without login. Accessing this path allows attacker to obtain the database credential with the highest privilege and database host IP address. With this information, attackers can connect to the database and perform actions such as adding, modifying, or deleting database contents.

Affected products (as reported)

Vendor	Product	Versions
E-WEBInformationCo.	FS-EZViewer(Web)	earlier – through 10.4.0.x

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.twcert.org.tw/tw/cp-132-7774-fbd01-1.html third-party-advisory