Vulnerability-Lookup

CVE-2024-0949 (GCVE-0-2024-0949)

Vulnerability from cvelistv5 – Published: 2024-06-27 09:36 – Updated: 2026-06-03 14:33

Title

Improper Access Control in Talya Informatics' Elektraweb

Summary

Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows Authentication Bypass. This issue affects Elektraweb: before v17.0.68.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-07-24 13:32 UTC

CWE

CWE-306 - Missing Authentication
CWE-552 - Files or Directories Accessible to External Parties
CWE-798 - Use of Hard-coded Credentials

Assigner

TR-CERT mitre root Scorecard

References

2 references

URL	Tags
https://www.usom.gov.tr/bildirim/tr-24-0808	government-resourcebroken-link
https://siberguvenlik.gov.tr/guvenlik-bildirimler…	government-resource

Impacted products

2 products

Vendor	Product	Version
Talya Informatics	Elektraweb	Affected: 0 , < v17.0.68 (custom)
talya_informatics	elektraweb	Affected: 0 , < v17.0.68 (custom) cpe:2.3:a:talya_informatics:elektraweb::::::::

Credits

Yusuf Kamil ÇAVUŞOĞLU

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:talya_informatics:elektraweb:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "elektraweb",
            "vendor": "talya_informatics",
            "versions": [
              {
                "lessThan": "v17.0.68",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-0949",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-24T13:32:07.238546Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-24T13:37:21.437Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:26:28.980Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.usom.gov.tr/bildirim/tr-24-0808"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Elektraweb",
          "vendor": "Talya Informatics",
          "versions": [
            {
              "lessThan": "v17.0.68",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yusuf Kamil \u00c7AVU\u015eO\u011eLU"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows Authentication Bypass.\u003cp\u003eThis issue affects Elektraweb: before v17.0.68.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows Authentication Bypass.\n\nThis issue affects Elektraweb: before v17.0.68."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-552",
              "description": "CWE-552 Files or Directories Accessible to External Parties",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "CWE-798 Use of Hard-coded Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-03T14:33:56.768Z",
        "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "shortName": "TR-CERT"
      },
      "references": [
        {
          "tags": [
            "government-resource",
            "broken-link"
          ],
          "url": "https://www.usom.gov.tr/bildirim/tr-24-0808"
        },
        {
          "tags": [
            "government-resource"
          ],
          "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-0808"
        }
      ],
      "source": {
        "advisory": "TR-24-0808",
        "defect": [
          "TR-24-0808"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Improper Access Control in Talya Informatics\u0027 Elektraweb",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
    "assignerShortName": "TR-CERT",
    "cveId": "CVE-2024-0949",
    "datePublished": "2024-06-27T09:36:59.897Z",
    "dateReserved": "2024-01-26T13:00:20.711Z",
    "dateUpdated": "2026-06-03T14:33:56.768Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-0949",
      "date": "2026-10-04",
      "epss": "0.00533",
      "percentile": "0.43001"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Elektraweb",
                "vendor": "Talya Informatics",
                "versions": [
                  {
                    "lessThan": "v17.0.68",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "iletisim@usom.gov.tr"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:talya_informatics:elektraweb:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "product": "elektraweb",
                "vendor": "talya_informatics",
                "versions": [
                  {
                    "lessThan": "v17.0.68",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows Authentication Bypass.\n\nThis issue affects Elektraweb: before v17.0.68."
          },
          {
            "lang": "es",
            "value": "Vulnerabilidades de control de acceso inadecuado, autorizaci\u00f3n faltante, autorizaci\u00f3n incorrecta, asignaci\u00f3n de permisos incorrecta para recursos cr\u00edticos, autenticaci\u00f3n faltante, autenticaci\u00f3n d\u00e9bil, restricci\u00f3n inadecuada del canal de comunicaci\u00f3n a los endpoint previstos en Talya Informatics Elektraweb permiten explotar niveles de seguridad de control de acceso configurados incorrectamente, manipular la entrada web a las Llamadas al sistema de archivos, incrustaci\u00f3n de scripts dentro de scripts, inserci\u00f3n de l\u00f3gica maliciosa, modificaci\u00f3n de la configuraci\u00f3n del servicio de Windows, certificado ra\u00edz malicioso, intento de falsificaci\u00f3n , exposici\u00f3n de WebView, datos inyectados durante la configuraci\u00f3n, eliminaci\u00f3n incompleta de datos en un entorno multi tenant, instalaci\u00f3n de un nuevo servicio, modificaci\u00f3n de un servicio existente , Instalar Rootkit, Reemplazar controladores de extensi\u00f3n de archivos, Reemplazar ejecutable confiable, Modificar archivo compartido, Agregar archivo malicioso a Webroot compartido, Ejecutar software al iniciar sesi\u00f3n, Deshabilitar software de seguridad. Este problema afecta a Elektraweb: anterior a v17.0.68."
          }
        ],
        "id": "CVE-2024-0949",
        "lastModified": "2026-06-17T06:54:37.857",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "iletisim@usom.gov.tr",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-0949",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-24T13:32:07.238546Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-06-27T10:15:13.013",
        "references": [
          {
            "source": "iletisim@usom.gov.tr",
            "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-0808"
          },
          {
            "source": "iletisim@usom.gov.tr",
            "url": "https://www.usom.gov.tr/bildirim/tr-24-0808"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://www.usom.gov.tr/bildirim/tr-24-0808"
          }
        ],
        "sourceIdentifier": "iletisim@usom.gov.tr",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-306"
              },
              {
                "lang": "en",
                "value": "CWE-552"
              },
              {
                "lang": "en",
                "value": "CWE-798"
              }
            ],
            "source": "iletisim@usom.gov.tr",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-01T18:26:28.980Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://www.usom.gov.tr/bildirim/tr-24-0808"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:talya_informatics:elektraweb:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "product": "elektraweb",
                "vendor": "talya_informatics",
                "versions": [
                  {
                    "lessThan": "v17.0.68",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-0949",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-07-24T13:32:07.238546Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-07-24T13:35:16.680Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Elektraweb",
              "vendor": "Talya Informatics",
              "versions": [
                {
                  "lessThan": "v17.0.68",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Yusuf Kamil \u00c7AVU\u015eO\u011eLU"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows Authentication Bypass.\u003cp\u003eThis issue affects Elektraweb: before v17.0.68.\u003c/p\u003e"
                }
              ],
              "value": "Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows Authentication Bypass.\n\nThis issue affects Elektraweb: before v17.0.68."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-115",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-115 Authentication Bypass"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-306",
                  "description": "CWE-306 Missing Authentication",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-552",
                  "description": "CWE-552 Files or Directories Accessible to External Parties",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-798",
                  "description": "CWE-798 Use of Hard-coded Credentials",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-03T14:33:56.768Z",
            "orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
            "shortName": "TR-CERT"
          },
          "references": [
            {
              "tags": [
                "government-resource",
                "broken-link"
              ],
              "url": "https://www.usom.gov.tr/bildirim/tr-24-0808"
            },
            {
              "tags": [
                "government-resource"
              ],
              "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-0808"
            }
          ],
          "source": {
            "advisory": "TR-24-0808",
            "defect": [
              "TR-24-0808"
            ],
            "discovery": "UNKNOWN"
          },
          "title": "Improper Access Control in Talya Informatics\u0027 Elektraweb",
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
        "assignerShortName": "TR-CERT",
        "cveId": "CVE-2024-0949",
        "datePublished": "2024-06-27T09:36:59.897Z",
        "dateReserved": "2024-01-26T13:00:20.711Z",
        "dateUpdated": "2026-06-03T14:33:56.768Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

EUVD-2026-324385

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 07:45

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T07:45:27.960189+00:00",
  "id": "EUVD-2026-324385"
}

FKIE_CVE-2024-0949

Vulnerability from fkie_nvd - Published: 2024-06-27 10:15 - Updated: 2026-06-17 06:54

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	iletisim@usom.gov.tr	https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-0808
	iletisim@usom.gov.tr	https://www.usom.gov.tr/bildirim/tr-24-0808
	af854a3a-2127-422b-91ae-364da2661108	https://www.usom.gov.tr/bildirim/tr-24-0808

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Elektraweb",
          "vendor": "Talya Informatics",
          "versions": [
            {
              "lessThan": "v17.0.68",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "iletisim@usom.gov.tr"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:talya_informatics:elektraweb:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "elektraweb",
          "vendor": "talya_informatics",
          "versions": [
            {
              "lessThan": "v17.0.68",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows Authentication Bypass.\n\nThis issue affects Elektraweb: before v17.0.68."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidades de control de acceso inadecuado, autorizaci\u00f3n faltante, autorizaci\u00f3n incorrecta, asignaci\u00f3n de permisos incorrecta para recursos cr\u00edticos, autenticaci\u00f3n faltante, autenticaci\u00f3n d\u00e9bil, restricci\u00f3n inadecuada del canal de comunicaci\u00f3n a los endpoint previstos en Talya Informatics Elektraweb permiten explotar niveles de seguridad de control de acceso configurados incorrectamente, manipular la entrada web a las Llamadas al sistema de archivos, incrustaci\u00f3n de scripts dentro de scripts, inserci\u00f3n de l\u00f3gica maliciosa, modificaci\u00f3n de la configuraci\u00f3n del servicio de Windows, certificado ra\u00edz malicioso, intento de falsificaci\u00f3n , exposici\u00f3n de WebView, datos inyectados durante la configuraci\u00f3n, eliminaci\u00f3n incompleta de datos en un entorno multi tenant, instalaci\u00f3n de un nuevo servicio, modificaci\u00f3n de un servicio existente , Instalar Rootkit, Reemplazar controladores de extensi\u00f3n de archivos, Reemplazar ejecutable confiable, Modificar archivo compartido, Agregar archivo malicioso a Webroot compartido, Ejecutar software al iniciar sesi\u00f3n, Deshabilitar software de seguridad. Este problema afecta a Elektraweb: anterior a v17.0.68."
    }
  ],
  "id": "CVE-2024-0949",
  "lastModified": "2026-06-17T06:54:37.857",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "iletisim@usom.gov.tr",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-0949",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-07-24T13:32:07.238546Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-06-27T10:15:13.013",
  "references": [
    {
      "source": "iletisim@usom.gov.tr",
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-0808"
    },
    {
      "source": "iletisim@usom.gov.tr",
      "url": "https://www.usom.gov.tr/bildirim/tr-24-0808"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.usom.gov.tr/bildirim/tr-24-0808"
    }
  ],
  "sourceIdentifier": "iletisim@usom.gov.tr",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        },
        {
          "lang": "en",
          "value": "CWE-552"
        },
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ],
      "source": "iletisim@usom.gov.tr",
      "type": "Secondary"
    }
  ]
}

GHSA-VH95-79CJ-7HVX

Vulnerability from github – Published: 2024-06-27 12:30 – Updated: 2026-06-03 18:33

Details

Improper Access Control, Missing Authorization, Incorrect Authorization, Incorrect Permission Assignment for Critical Resource, Missing Authentication, Weak Authentication, Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Talya Informatics Elektraweb allows Exploiting Incorrectly Configured Access Control Security Levels, Manipulating Web Input to File System Calls, Embedding Scripts within Scripts, Malicious Logic Insertion, Modification of Windows Service Configuration, Malicious Root Certificate, Intent Spoof, WebView Exposure, Data Injected During Configuration, Incomplete Data Deletion in a Multi-Tenant Environment, Install New Service, Modify Existing Service, Install Rootkit, Replace File Extension Handlers, Replace Trusted Executable, Modify Shared File, Add Malicious File to Shared Webroot, Run Software at Logon, Disable Security Software.This issue affects Elektraweb: before v17.0.68.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-0949"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1390",
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-27T10:15:13Z",
    "severity": "CRITICAL"
  },
  "details": "Improper Access Control, Missing Authorization, Incorrect Authorization, Incorrect Permission Assignment for Critical Resource, Missing Authentication, Weak Authentication, Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Talya Informatics Elektraweb allows Exploiting Incorrectly Configured Access Control Security Levels, Manipulating Web Input to File System Calls, Embedding Scripts within Scripts, Malicious Logic Insertion, Modification of Windows Service Configuration, Malicious Root Certificate, Intent Spoof, WebView Exposure, Data Injected During Configuration, Incomplete Data Deletion in a Multi-Tenant Environment, Install New Service, Modify Existing Service, Install Rootkit, Replace File Extension Handlers, Replace Trusted Executable, Modify Shared File, Add Malicious File to Shared Webroot, Run Software at Logon, Disable Security Software.This issue affects Elektraweb: before v17.0.68.",
  "id": "GHSA-vh95-79cj-7hvx",
  "modified": "2026-06-03T18:33:05Z",
  "published": "2024-06-27T12:30:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0949"
    },
    {
      "type": "WEB",
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-0808"
    },
    {
      "type": "WEB",
      "url": "https://www.usom.gov.tr/bildirim/tr-24-0808"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2024-0949

Vulnerability from gsd - Updated: 2024-01-27 06:03

Details

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Aliases

CVE-2024-0949

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-0949"
      ],
      "id": "GSD-2024-0949",
      "modified": "2024-01-27T06:03:13.411050Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2024-0949",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-0949 (GCVE-0-2024-0949)

EUVD-2026-324385

FKIE_CVE-2024-0949

GHSA-VH95-79CJ-7HVX

GSD-2024-0949

Tags

Sightings

Nomenclature

Related by attack behaviour