CVE-2024-11071

HIGH

Cyberdigm DestinyECM - Cross-Site Request Forgery via JSON Hijacking

Title source: llm
STIX 2.1

Description

Permissive Cross-domain Policy with Untrusted Domains vulnerability in local API server of DestinyECM solution(versions described below) which is developed and maintained by Cyberdigm may allow Cross-Site Request Forgery (CSRF) attack, which probabilistically enables JSON Hijacking (aka JavaScript Hijacking) via forgery web page.* Due to product customization, version information may differ from the following version description. For further inquiries, please contact the vendor.

References (1)

Core 1
Core References

Scores

CVSS v3 8.8
EPSS 0.0017
EPSS Percentile 6.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-352 CWE-942
Status published
Products (5)
Cyberdigm/DestinyECM 5.21.*, 5.20.*, 5.19.* - 5.21.12.2303
Cyberdigm/DestinyECM 5.22.* - 5.22.12.2446
Cyberdigm/DestinyECM 5.23.02.* - 5.23.08.2451
Cyberdigm/DestinyECM 5.23.10.* - 5.23.12.2450
Cyberdigm/DestinyECM 5.24.10.* - 5.24.10.2303
Published Apr 07, 2025
Tracked Since Feb 18, 2026