CVE-2024-8778

MEDIUM

OMFLOW 1.1.6.0-1.2.1.2 - Path Traversal via Download Functionality

Title source: llm
STIX 2.1

Description

OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality, allowing remote attackers with regular privileges to read arbitrary system files.

References (2)

Core 2
Core References
Third Party Advisory third-party-advisory
https://www.twcert.org.tw/tw/cp-132-8073-ff771-1.html
Third Party Advisory third-party-advisory
https://www.twcert.org.tw/en/cp-139-8074-66457-2.html

Scores

CVSS v3 6.5
EPSS 0.0059
EPSS Percentile 43.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-22 CWE-36
Status published
Products (1)
syscomgo/omflow 1.1.6.0 - 1.2.1.3
Published Sep 16, 2024
Tracked Since Feb 18, 2026