CVE-2024-13042

MEDIUM

Tsinghua Unigroup Electronic Archives Management System 3.2.210802 ...

Title source: llm
STIX 2.1

Description

A vulnerability was found in Tsinghua Unigroup Electronic Archives Management System 3.2.210802(62532). It has been classified as problematic. Affected is the function download of the file /Searchnew/Subject/download.html. The manipulation of the argument path leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

References (5)

Core 5
Core References
Permissions Required, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.289788
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.289788
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.472068
Various Sources broken-link
https://github.com/BxYQ/zg_fileread
Various Sources broken-link exploit
https://github.com/BxYQ/zg_fileread/blob/main/poc.py

Scores

CVSS v3 4.3
EPSS 0.0003
EPSS Percentile 7.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-200 CWE-284
Status published
Products (1)
Tsinghua Unigroup/Electronic Archives Management System 3.2.210802(62532)
Published Dec 30, 2024
Tracked Since Feb 18, 2026