CVE-2024-26263

MEDIUM

EBM Technologies RISWEB 1.0-3.0 - Unauthenticated Sensitive Data Exposure via Unprotected URL Path

Title source: llm
STIX 2.1

Description

EBM Technologies RISWEB's specific URL path is not properly controlled by permission, allowing attackers to browse specific pages and query sensitive data without login.

References (1)

Core 1
Core References
Third Party Advisory third-party-advisory
https://www.twcert.org.tw/tw/cp-132-7676-9418d-1.html

Scores

CVSS v3 5.3
EPSS 0.0042
EPSS Percentile 33.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-306
Status published
Products (1)
ebmtech/risweb 1.0 - 3.0
Published Feb 15, 2024
Tracked Since Feb 18, 2026