CVE-2024-8774

HIGH

Privilege Escalation in SIMPLE.ERP

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-8774 has a selected CVSS score of 7.7 (high).

Description

The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges to a database administrator. This issue affect SIMPLE.ERP from 6.20 through 6.30. Only the 6.30 version received a patch 6.30@a03.9, which removed the vulnerability. Versions 6.20 and 6.25 remain unpatched.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 24, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

SIMPLE.ERP

Browse Simple SA / SIMPLE.ERP

Default status: unaffected

CVE List6.20 to < 6.30@a03.9affected

References

4