Lucene search

MitreCVE-2024-38289

HistoryJul 25, 2024 - 8:15 p.m.

CVE-2024-38289

2024-07-2520:15:05

CWE-89

mitre

web.nvd.nist.gov

cve-2024-38289

boolean-based sql

remote attackers

hashed passwords

database extraction

unauthenticated

crafted sql input

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

Low

EPSS

0.009

Percentile

82.7%

JSON

A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to extract hashed passwords from the database, and authenticate to the application, via crafted SQL input.

Affected configurations

Nvd

Node

rhubcomturbomeetingRange≤8.0

VendorProductVersionCPE
rhubcomturbomeeting*cpe:2.3:a:rhubcom:turbomeeting:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
rhubcom	turbomeeting	*	cpe:2.3:a:rhubcom:turbomeeting::::::::

References

github.com/google/security-research/security/advisories/GHSA-vx5j-8pgx-v42v

www.rhubcom.com/v5/manuals.html

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

Low

EPSS

0.009

Percentile

82.7%

JSON

Related for CVE-2024-38289