CVE-2024-10598

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-10598", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2024-10-31T15:24:59.187Z", "datePublished": "2024-10-31T21:31:04.186Z", "dateUpdated": "2024-11-01T14:36:22.768Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2024-10-31T21:31:04.186Z"}, "title": "Tongda OA Annual Leave data.php improper authorization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "Improper Authorization"}]}], "affected": [{"vendor": "Tongda", "product": "OA", "versions": [{"version": "11.2", "status": "affected"}, {"version": "11.3", "status": "affected"}, {"version": "11.4", "status": "affected"}, {"version": "11.5", "status": "affected"}, {"version": "11.6", "status": "affected"}], "modules": ["Annual Leave Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability classified as critical was found in Tongda OA 11.2/11.3/11.4/11.5/11.6. This vulnerability affects unknown code of the file general/hr/setting/attendance/leave/data.php of the component Annual Leave Handler. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used."}, {"lang": "de", "value": "In Tongda OA 11.2/11.3/11.4/11.5/11.6 wurde eine Schwachstelle entdeckt. Sie wurde als kritisch eingestuft. Es geht um eine nicht n\u00e4her bekannte Funktion der Datei general/hr/setting/attendance/leave/data.php der Komponente Annual Leave Handler. Durch das Beeinflussen mit unbekannten Daten kann eine improper authorization-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}], "timeline": [{"time": "2024-10-31T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2024-10-31T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2024-10-31T16:30:22.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "LVZC (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.282610", "name": "VDB-282610 | Tongda OA Annual Leave data.php improper authorization", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.282610", "name": "VDB-282610 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.433495", "name": "Submit #433495 | Beijing Tongda Xinke Technology Co., Ltd Tongda OA v11.2-v11.6 unauthorized access", "tags": ["third-party-advisory"]}, {"url": "https://github.com/LvZCh/td/issues/1", "tags": ["exploit", "issue-tracking"]}]}, "adp": [{"affected": [{"vendor": "tongda", "product": "oa_2017", "cpes": ["cpe:2.3:a:tongda:oa_2017:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "11.2", "status": "affected"}, {"version": "11.3", "status": "affected"}, {"version": "11.4", "status": "affected"}, {"version": "11.5", "status": "affected"}, {"version": "11.6", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-01T14:35:38.661395Z", "id": "CVE-2024-10598", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-01T14:36:22.768Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-10598", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-01T14:35:38.661395Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:tongda:oa_2017:*:*:*:*:*:*:*:*"], "vendor": "tongda", "product": "oa_2017", "versions": [{"status": "affected", "version": "11.2"}, {"status": "affected", "version": "11.3"}, {"status": "affected", "version": "11.4"}, {"status": "affected", "version": "11.5"}, {"status": "affected", "version": "11.6"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-01T14:36:16.263Z"}}], "cna": {"title": "Tongda OA Annual Leave data.php improper authorization", "credits": [{"lang": "en", "type": "reporter", "value": "LVZC (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}], "affected": [{"vendor": "Tongda", "modules": ["Annual Leave Handler"], "product": "OA", "versions": [{"status": "affected", "version": "11.2"}, {"status": "affected", "version": "11.3"}, {"status": "affected", "version": "11.4"}, {"status": "affected", "version": "11.5"}, {"status": "affected", "version": "11.6"}]}], "timeline": [{"lang": "en", "time": "2024-10-31T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2024-10-31T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2024-10-31T16:30:22.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.282610", "name": "VDB-282610 | Tongda OA Annual Leave data.php improper authorization", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.282610", "name": "VDB-282610 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.433495", "name": "Submit #433495 | Beijing Tongda Xinke Technology Co., Ltd Tongda OA v11.2-v11.6 unauthorized access", "tags": ["third-party-advisory"]}, {"url": "https://github.com/LvZCh/td/issues/1", "tags": ["exploit", "issue-tracking"]}], "descriptions": [{"lang": "en", "value": "A vulnerability classified as critical was found in Tongda OA 11.2/11.3/11.4/11.5/11.6. This vulnerability affects unknown code of the file general/hr/setting/attendance/leave/data.php of the component Annual Leave Handler. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used."}, {"lang": "de", "value": "In Tongda OA 11.2/11.3/11.4/11.5/11.6 wurde eine Schwachstelle entdeckt. Sie wurde als kritisch eingestuft. Es geht um eine nicht n\u00e4her bekannte Funktion der Datei general/hr/setting/attendance/leave/data.php der Komponente Annual Leave Handler. Durch das Beeinflussen mit unbekannten Daten kann eine improper authorization-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "Improper Authorization"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2024-10-31T21:31:04.186Z"}}}, "cveMetadata": {"cveId": "CVE-2024-10598", "state": "PUBLISHED", "dateUpdated": "2024-11-01T14:36:22.768Z", "dateReserved": "2024-10-31T15:24:59.187Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2024-10-31T21:31:04.186Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"modules": ["Annual Leave Handler"], "product": "OA", "vendor": "Tongda", "versions": [{"status": "affected", "version": "11.2"}, {"status": "affected", "version": "11.3"}, {"status": "affected", "version": "11.4"}, {"status": "affected", "version": "11.5"}, {"status": "affected", "version": "11.6"}]}], "source": "cna@vuldb.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:tongda:oa_2017:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "oa_2017", "vendor": "tongda", "versions": [{"status": "affected", "version": "11.2"}, {"status": "affected", "version": "11.3"}, {"status": "affected", "version": "11.4"}, {"status": "affected", "version": "11.5"}, {"status": "affected", "version": "11.6"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tongda2000:office_anywhere:*:*:*:*:*:*:*:*", "matchCriteriaId": "C756DF9A-7043-4989-8EC6-5614A809B53B", "versionEndIncluding": "11.6", "versionStartIncluding": "11.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability classified as critical was found in Tongda OA 11.2/11.3/11.4/11.5/11.6. This vulnerability affects unknown code of the file general/hr/setting/attendance/leave/data.php of the component Annual Leave Handler. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used."}, {"lang": "es", "value": " Se ha encontrado una vulnerabilidad clasificada como cr\u00edtica en Tongda OA 11.2/11.3/11.4/11.5/11.6. Esta vulnerabilidad afecta al c\u00f3digo desconocido del archivo general/hr/setting/attendance/leave/data.php del componente Annual Leave Handler. La manipulaci\u00f3n conduce a una autorizaci\u00f3n indebida. El ataque puede iniciarse de forma remota. El exploit ha sido divulgado al p\u00fablico y puede utilizarse."}], "id": "CVE-2024-10598", "lastModified": "2026-06-17T06:56:00.747", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-10598", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-11-01T14:35:38.661395Z", "version": "2.0.3"}}]}, "published": "2024-10-31T22:15:02.960", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/LvZCh/td/issues/1"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.282610"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.282610"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.433495"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "cna@vuldb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-862"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}