CVE-2024-11071 — Improper Access Control In DestinyECM

Description (CNA)

Permissive Cross-domain Policy with Untrusted Domains vulnerability in local API server of DestinyECM solution(versions described below) which is developed and maintained by Cyberdigm may allow Cross-Site Request Forgery (CSRF) attack, which probabilistically enables JSON Hijacking (aka JavaScript Hijacking) via forgery web page.* Due to product customization, version information may differ from the following version description. For further inquiries, please contact the vendor.

Affected (CNA)

Vendor / product	Versions
Cyberdigm / DestinyECM	affected 5.24.10.* before 5.24.10.2303; affected 5.23.10.* before 5.23.12.2450; affected 5.23.02.* before 5.23.08.2451; affected 5.22.* before 5.22.12.2446; affected 5.21., 5.20., 5.19.* before 5.21.12.2303

CWE

CWE-352, CWE-942

References

https://cyberdigm.co.kr/destinyEcm

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.