CVE-2024-24216

CRITICAL

Zentao 18.0-18.10 - Remote Code Execution via checkConnection Method

Title source: llm

Description

Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/module/repo/model.php.

References (2)

Core 2

Core References

Exploit, Third Party Advisory

https://github.com/l3s10n/ZenTaoPMS_RCE

Issue Tracking

https://github.com/easysoft/zentaopms/issues/133

Scores

CVSS v3 9.8

EPSS 0.0127

EPSS Percentile 66.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-77

Status published

Products (1)

easycorp/zentao 18.0 - 18.10

Published Feb 08, 2024

Tracked Since Feb 18, 2026