Search
Find a vulnerability
Search criteria
4 vulnerabilities by guangzhou_huayi_intelligent_technology
CVE-2024-12347 (GCVE-0-2024-12347)
Vulnerability from nvd – Published: 2024-12-08 23:31 – Updated: 2024-12-09 15:44
VLAI
EPSS
VEX
Title
Guangzhou Huayi Intelligent Technology Jeewms Druid Monitoring Interface index.html improper authorization
Summary
A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms up to 1.0.0 and classified as critical. This issue affects some unknown processing of the file /jeewms_war/webpage/system/druid/index.html of the component Druid Monitoring Interface. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
5.3 (Medium)
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-09 15:42 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.287267 | vdb-entry |
| https://vuldb.com/?ctiid.287267 | signaturepermissions-required |
| https://vuldb.com/?submit.453917 | third-party-advisory |
| https://github.com/dycccccccc/JEEWMS/blob/main/JE… | exploit |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Guangzhou Huayi Intelligent Technology | Jeewms |
Affected:
1.0
|
|
| guangzhou_huayi_intelligent_technology | jeewms |
Affected:
1.0
cpe:2.3:a:guangzhou_huayi_intelligent_technology:jeewms:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:guangzhou_huayi_intelligent_technology:jeewms:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "jeewms",
"vendor": "guangzhou_huayi_intelligent_technology",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12347",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-09T15:42:27.005429Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-09T15:44:23.504Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Druid Monitoring Interface"
],
"product": "Jeewms",
"vendor": "Guangzhou Huayi Intelligent Technology",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dycc (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms up to 1.0.0 and classified as critical. This issue affects some unknown processing of the file /jeewms_war/webpage/system/druid/index.html of the component Druid Monitoring Interface. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Eine kritische Schwachstelle wurde in Guangzhou Huayi Intelligent Technology Jeewms bis 1.0.0 gefunden. Dies betrifft einen unbekannten Teil der Datei /jeewms_war/webpage/system/druid/index.html der Komponente Druid Monitoring Interface. Mit der Manipulation mit unbekannten Daten kann eine improper authorization-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-08T23:31:07.459Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-287267 | Guangzhou Huayi Intelligent Technology Jeewms Druid Monitoring Interface index.html improper authorization",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.287267"
},
{
"name": "VDB-287267 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.287267"
},
{
"name": "Submit #453917 | Guangzhou Huayi Intelligent Technology Co., Ltd. JEEWMS \u003c= 1.0.0 unauthorized access",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.453917"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/dycccccccc/JEEWMS/blob/main/JEEWMS%20Druid%20monitoring%20interface%20is%20not%20authorized.docx"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-12-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-12-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-12-08T09:28:05.000Z",
"value": "VulDB entry last update"
}
],
"title": "Guangzhou Huayi Intelligent Technology Jeewms Druid Monitoring Interface index.html improper authorization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-12347",
"datePublished": "2024-12-08T23:31:07.459Z",
"dateReserved": "2024-12-08T08:23:01.677Z",
"dateUpdated": "2024-12-09T15:44:23.504Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11961 (GCVE-0-2024-11961)
Vulnerability from nvd – Published: 2024-11-28 15:00 – Updated: 2024-11-29 15:18
VLAI
EPSS
VEX
Title
Guangzhou Huayi Intelligent Technology Jeewms WmOmNoticeHController.java preHandle information disclosure
Summary
A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms 3.7. It has been rated as problematic. This issue affects the function preHandle of the file src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java. The manipulation of the argument request leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
5.3 (Medium)
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-29 15:16 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.286343 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.286343 | signaturepermissions-required |
| https://vuldb.com/?submit.445596 | third-party-advisory |
| https://github.com/dycccccccc/JEEWMS/blob/main/JE… | exploit |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Guangzhou Huayi Intelligent Technology | Jeewms |
Affected:
3.7
|
|
| guangzhou_huayi_intelligent_technology | jeewms |
Affected:
3.7
cpe:2.3:a:guangzhou_huayi_intelligent_technology:jeewms:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:guangzhou_huayi_intelligent_technology:jeewms:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "jeewms",
"vendor": "guangzhou_huayi_intelligent_technology",
"versions": [
{
"status": "affected",
"version": "3.7"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11961",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T15:16:29.384289Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T15:18:50.394Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Jeewms",
"vendor": "Guangzhou Huayi Intelligent Technology",
"versions": [
{
"status": "affected",
"version": "3.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dycc (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms 3.7. It has been rated as problematic. This issue affects the function preHandle of the file src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java. The manipulation of the argument request leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Eine Schwachstelle wurde in Guangzhou Huayi Intelligent Technology Jeewms 3.7 ausgemacht. Sie wurde als problematisch eingestuft. Betroffen davon ist die Funktion preHandle der Datei src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java. Mit der Manipulation des Arguments request mit unbekannten Daten kann eine information disclosure-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-28T15:00:08.998Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-286343 | Guangzhou Huayi Intelligent Technology Jeewms WmOmNoticeHController.java preHandle information disclosure",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.286343"
},
{
"name": "VDB-286343 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.286343"
},
{
"name": "Submit #445596 | Guangzhou Huayi Intelligent Technology Co., Ltd. JEEWMS 3.7 Information Leakage",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.445596"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/dycccccccc/JEEWMS/blob/main/JEEWMS%20Shipper%20Information%20Leakage.docx"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-11-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-11-28T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-11-28T10:09:59.000Z",
"value": "VulDB entry last update"
}
],
"title": "Guangzhou Huayi Intelligent Technology Jeewms WmOmNoticeHController.java preHandle information disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-11961",
"datePublished": "2024-11-28T15:00:08.998Z",
"dateReserved": "2024-11-28T09:04:47.608Z",
"dateUpdated": "2024-11-29T15:18:50.394Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12347 (GCVE-0-2024-12347)
Vulnerability from cvelistv5 – Published: 2024-12-08 23:31 – Updated: 2024-12-09 15:44
VLAI
EPSS
VEX
Title
Guangzhou Huayi Intelligent Technology Jeewms Druid Monitoring Interface index.html improper authorization
Summary
A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms up to 1.0.0 and classified as critical. This issue affects some unknown processing of the file /jeewms_war/webpage/system/druid/index.html of the component Druid Monitoring Interface. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
5.3 (Medium)
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-09 15:42 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.287267 | vdb-entry |
| https://vuldb.com/?ctiid.287267 | signaturepermissions-required |
| https://vuldb.com/?submit.453917 | third-party-advisory |
| https://github.com/dycccccccc/JEEWMS/blob/main/JE… | exploit |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Guangzhou Huayi Intelligent Technology | Jeewms |
Affected:
1.0
|
|
| guangzhou_huayi_intelligent_technology | jeewms |
Affected:
1.0
cpe:2.3:a:guangzhou_huayi_intelligent_technology:jeewms:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:guangzhou_huayi_intelligent_technology:jeewms:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "jeewms",
"vendor": "guangzhou_huayi_intelligent_technology",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12347",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-09T15:42:27.005429Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-09T15:44:23.504Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Druid Monitoring Interface"
],
"product": "Jeewms",
"vendor": "Guangzhou Huayi Intelligent Technology",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dycc (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms up to 1.0.0 and classified as critical. This issue affects some unknown processing of the file /jeewms_war/webpage/system/druid/index.html of the component Druid Monitoring Interface. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Eine kritische Schwachstelle wurde in Guangzhou Huayi Intelligent Technology Jeewms bis 1.0.0 gefunden. Dies betrifft einen unbekannten Teil der Datei /jeewms_war/webpage/system/druid/index.html der Komponente Druid Monitoring Interface. Mit der Manipulation mit unbekannten Daten kann eine improper authorization-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-08T23:31:07.459Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-287267 | Guangzhou Huayi Intelligent Technology Jeewms Druid Monitoring Interface index.html improper authorization",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.287267"
},
{
"name": "VDB-287267 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.287267"
},
{
"name": "Submit #453917 | Guangzhou Huayi Intelligent Technology Co., Ltd. JEEWMS \u003c= 1.0.0 unauthorized access",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.453917"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/dycccccccc/JEEWMS/blob/main/JEEWMS%20Druid%20monitoring%20interface%20is%20not%20authorized.docx"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-12-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-12-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-12-08T09:28:05.000Z",
"value": "VulDB entry last update"
}
],
"title": "Guangzhou Huayi Intelligent Technology Jeewms Druid Monitoring Interface index.html improper authorization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-12347",
"datePublished": "2024-12-08T23:31:07.459Z",
"dateReserved": "2024-12-08T08:23:01.677Z",
"dateUpdated": "2024-12-09T15:44:23.504Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11961 (GCVE-0-2024-11961)
Vulnerability from cvelistv5 – Published: 2024-11-28 15:00 – Updated: 2024-11-29 15:18
VLAI
EPSS
VEX
Title
Guangzhou Huayi Intelligent Technology Jeewms WmOmNoticeHController.java preHandle information disclosure
Summary
A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms 3.7. It has been rated as problematic. This issue affects the function preHandle of the file src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java. The manipulation of the argument request leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
5.3 (Medium)
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-29 15:16 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.286343 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.286343 | signaturepermissions-required |
| https://vuldb.com/?submit.445596 | third-party-advisory |
| https://github.com/dycccccccc/JEEWMS/blob/main/JE… | exploit |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Guangzhou Huayi Intelligent Technology | Jeewms |
Affected:
3.7
|
|
| guangzhou_huayi_intelligent_technology | jeewms |
Affected:
3.7
cpe:2.3:a:guangzhou_huayi_intelligent_technology:jeewms:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:guangzhou_huayi_intelligent_technology:jeewms:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "jeewms",
"vendor": "guangzhou_huayi_intelligent_technology",
"versions": [
{
"status": "affected",
"version": "3.7"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11961",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T15:16:29.384289Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T15:18:50.394Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Jeewms",
"vendor": "Guangzhou Huayi Intelligent Technology",
"versions": [
{
"status": "affected",
"version": "3.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dycc (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms 3.7. It has been rated as problematic. This issue affects the function preHandle of the file src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java. The manipulation of the argument request leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Eine Schwachstelle wurde in Guangzhou Huayi Intelligent Technology Jeewms 3.7 ausgemacht. Sie wurde als problematisch eingestuft. Betroffen davon ist die Funktion preHandle der Datei src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java. Mit der Manipulation des Arguments request mit unbekannten Daten kann eine information disclosure-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-28T15:00:08.998Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-286343 | Guangzhou Huayi Intelligent Technology Jeewms WmOmNoticeHController.java preHandle information disclosure",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.286343"
},
{
"name": "VDB-286343 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.286343"
},
{
"name": "Submit #445596 | Guangzhou Huayi Intelligent Technology Co., Ltd. JEEWMS 3.7 Information Leakage",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.445596"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/dycccccccc/JEEWMS/blob/main/JEEWMS%20Shipper%20Information%20Leakage.docx"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-11-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2024-11-28T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2024-11-28T10:09:59.000Z",
"value": "VulDB entry last update"
}
],
"title": "Guangzhou Huayi Intelligent Technology Jeewms WmOmNoticeHController.java preHandle information disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2024-11961",
"datePublished": "2024-11-28T15:00:08.998Z",
"dateReserved": "2024-11-28T09:04:47.608Z",
"dateUpdated": "2024-11-29T15:18:50.394Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}