CVE-2024-3775 - Vulnerability Details - OpenCVE

aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitrary arguments to youtube-dl.exe, leading to the download of partial unauthorized files.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://www.twcert.org.tw/tw/cp-132-7726-e5f70-1.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2024-04-15T02:41:18.782Z

Updated: 2024-08-01T20:20:01.574Z

Reserved: 2024-04-15T01:56:14.581Z

Link: CVE-2024-3775

Vulnrichment

Updated: 2024-08-01T20:20:01.574Z

NVD

Status : Awaiting Analysis

Published: 2024-04-15T04:15:16.137

Modified: 2024-11-21T09:30:22.403

Link: CVE-2024-3775

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-3775", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2024-04-15T01:56:14.581Z", "datePublished": "2024-04-15T02:41:18.782Z", "dateUpdated": "2024-08-01T20:20:01.574Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "a+HRD", "vendor": "aEnrich Technology", "versions": [{"status": "affected", "version": "6.8"}, {"status": "affected", "version": "7.0"}, {"status": "affected", "version": "7.1"}, {"status": "affected", "version": "7.2"}]}], "datePublic": "2024-04-15T02:45:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitrary arguments to youtube-dl.exe, leading to the download of partial unauthorized files."}], "value": "aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitrary arguments to youtube-dl.exe, leading to the download of partial unauthorized files."}], "impacts": [{"capecId": "CAPEC-6", "descriptions": [{"lang": "en", "value": "CAPEC-6 Argument Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-88", "description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-04-15T02:50:03.220Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-7726-e5f70-1.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to eHRD 6.8.1039V1055 or later version<br>Update to eHRD 7.0.1141V422 or later version<br>Update to eHRD 7.1.1033V429 or later version<br>Update to eHRD 7.2.1061V36 or later version"}], "value": "Update to eHRD 6.8.1039V1055 or later version\nUpdate to eHRD 7.0.1141V422 or later version\nUpdate to eHRD 7.1.1033V429 or later version\nUpdate to eHRD 7.2.1061V36 or later version"}], "source": {"advisory": "TVN-202404003", "discovery": "EXTERNAL"}, "title": "aEnrich Technology a+HRD - Argument Injection", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "aenrich", "product": "a\\+hrd", "cpes": ["cpe:2.3:a:aenrich:a\\+hrd:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "6.8", "status": "affected", "lessThan": "6.8.1039V1055", "versionType": "custom"}, {"version": "7.0", "status": "affected", "lessThan": "7.0.1141V422", "versionType": "custom"}, {"version": "7.1", "status": "affected", "lessThan": "7.1.1033V429", "versionType": "custom"}, {"version": "7.2", "status": "affected", "lessThan": "7.2.1061V36", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-03T19:41:26.625409Z", "id": "CVE-2024-3775", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T12:48:08.114Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:20:01.574Z"}, "title": "CVE Program Container", "references": [{"tags": ["third-party-advisory", "x_transferred"], "url": "https://www.twcert.org.tw/tw/cp-132-7726-e5f70-1.html"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7726-e5f70-1.html", "tags": ["third-party-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:20:01.574Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-3775", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-03T19:41:26.625409Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:aenrich:a\\+hrd:*:*:*:*:*:*:*:*"], "vendor": "aenrich", "product": "a\\+hrd", "versions": [{"status": "affected", "version": "6.8", "lessThan": "6.8.1039V1055", "versionType": "custom"}, {"status": "affected", "version": "7.0", "lessThan": "7.0.1141V422", "versionType": "custom"}, {"status": "affected", "version": "7.1", "lessThan": "7.1.1033V429", "versionType": "custom"}, {"status": "affected", "version": "7.2", "lessThan": "7.2.1061V36", "versionType": "custom"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-03T19:46:43.503Z"}}], "cna": {"title": "aEnrich Technology a+HRD - Argument Injection", "source": {"advisory": "TVN-202404003", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-6", "descriptions": [{"lang": "en", "value": "CAPEC-6 Argument Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "aEnrich Technology", "product": "a+HRD", "versions": [{"status": "affected", "version": "6.8"}, {"status": "affected", "version": "7.0"}, {"status": "affected", "version": "7.1"}, {"status": "affected", "version": "7.2"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update to eHRD 6.8.1039V1055 or later version\nUpdate to eHRD 7.0.1141V422 or later version\nUpdate to eHRD 7.1.1033V429 or later version\nUpdate to eHRD 7.2.1061V36 or later version", "supportingMedia": [{"type": "text/html", "value": "Update to eHRD 6.8.1039V1055 or later version<br>Update to eHRD 7.0.1141V422 or later version<br>Update to eHRD 7.1.1033V429 or later version<br>Update to eHRD 7.2.1061V36 or later version", "base64": false}]}], "datePublic": "2024-04-15T02:45:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7726-e5f70-1.html", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitrary arguments to youtube-dl.exe, leading to the download of partial unauthorized files.", "supportingMedia": [{"type": "text/html", "value": "aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitrary arguments to youtube-dl.exe, leading to the download of partial unauthorized files.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-88", "description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2024-04-15T02:50:03.220Z"}}}, "cveMetadata": {"cveId": "CVE-2024-3775", "state": "PUBLISHED", "dateUpdated": "2024-08-01T20:20:01.574Z", "dateReserved": "2024-04-15T01:56:14.581Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2024-04-15T02:41:18.782Z", "assignerShortName": "twcert"}, "dataVersion": "5.1"}