Vulnerability · Published Aug 19, 2024 · Assigned by VulDB

CVE-2024-7919Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 GetDataList access control

Medium 5.3

In plain English

A medium-severity improper access control in Jieshun JieLink+ JSOTC2016 from Anhui Deshun Intelligent Technology. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)1.1%top 33.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as critical, has been found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805. This issue affects some unknown processing of the file /report/ParkChargeRecord/GetDataList. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
Anhui Deshun Intelligent Technology	Jieshun JieLink+ JSOTC2016	20240805

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

VDB-275069 | Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 GetDataList access control vdb-entry
VDB-275069 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #387124 | 安徽德顺智能科技有限公司 JIELINK+ INTELLIGENT TERMINAL OPERATION PLATROFM JSOTC2016 fJeLink+ Improper Access Controls third-party-advisory
https://wiki.shikangsi.com/post/share/fd390bd7-2d60-4ffb-87da-f72cc900f61c exploit