A vulnerability was found in Shanxi Diankeyun Technology NODERP up to 6.0.2 and classified as critical. This issue affects some unknown processing of the file application/index/common.php of the component Cookie Handler. The manipulation of the argument Nod_User_Id/Nod_User_Token leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252275. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
References
| Link | Resource |
|---|---|
| https://vuldb.com/?id.252275 | Third Party Advisory VDB Entry |
| https://vuldb.com/?ctiid.252275 | Permissions Required Third Party Advisory VDB Entry |
| https://note.zhaoj.in/share/vWuVlU2eg79t | Broken Link |
Configurations
History
13 Feb 2024, 19:49
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Shanxi Tianneng Technology
Shanxi Tianneng Technology noderp |
|
| References | () https://note.zhaoj.in/share/vWuVlU2eg79t - Broken Link | |
| References | () https://vuldb.com/?id.252275 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?ctiid.252275 - Permissions Required, Third Party Advisory, VDB Entry | |
| CPE | cpe:2.3:a:shanxi_tianneng_technology:noderp:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
29 Jan 2024, 16:19
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-29 16:15
Updated : 2024-05-17 02:35
NVD link : CVE-2024-1006
Mitre link : CVE-2024-1006
JSON object : View
Products Affected
shanxi_tianneng_technology
- noderp
CWE
CWE-287
Improper Authentication