CVE-2024-8780

MEDIUM

OMFLOW < 1.2.1.3 - Unauthorized Sensitive Information Exposure via Data Query Functionality

Title source: llm
STIX 2.1

Description

OMFLOW from The SYSCOM Group does not properly restrict the query range of its data query functionality, allowing remote attackers with regular privileges to obtain accounts and password hashes of other users.

References (2)

Core 2
Core References
Third Party Advisory third-party-advisory
https://www.twcert.org.tw/tw/cp-132-8077-7a7c0-1.html
Third Party Advisory third-party-advisory
https://www.twcert.org.tw/en/cp-139-8078-36fc9-2.html

Scores

CVSS v3 6.5
EPSS 0.0044
EPSS Percentile 34.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (1)
syscomgo/omflow < 1.2.1.3
Published Sep 16, 2024
Tracked Since Feb 18, 2026