Vulnerability · Published Sep 18, 2024 · Assigned by twcert
CVE-2024-8969The SYSCOM Group OMFLOW - Exposure of Sensitive Data
Medium 6.5
In plain English
A medium-severity information exposure in OMFLOW from The SYSCOM Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.5%top 59.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
OMFLOW from The SYSCOM Group has a vulnerability involving the exposure of sensitive data. This allows remote attackers who have logged into the system to obtain password hashes of all users and administrators.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The SYSCOM Group | OMFLOW | 0 – before 1.2.0 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://www.twcert.org.tw/tw/cp-132-8100-f6827-1.html third-party-advisory
- https://www.twcert.org.tw/en/cp-139-8101-193d8-2.html third-party-advisory