Lucene search

VulDBCVE-2024-7324

HistoryJul 31, 2024 - 6:15 p.m.

CVE-2024-7324

2024-07-3118:15:13

CWE-427

VulDB

web.nvd.nist.gov

iobit itop data recovery pro

critical vulnerability

uncontrolled search path

CVSS2

6.8

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

EPSS

Percentile

16.2%

JSON

A vulnerability was found in IObit iTop Data Recovery Pro 4.4.0.687. It has been declared as critical. Affected by this vulnerability is an unknown functionality in the library madbasic_.bpl of the component BPL Handler. The manipulation leads to uncontrolled search path. Local access is required to approach this attack. The associated identifier of this vulnerability is VDB-273247. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected configurations

Vulners

Vulnrichment

Node

iobititop_vpnMatch4.4.0.687

VendorProductVersionCPE
iobititop_vpn4.4.0.687cpe:2.3:a:iobit:itop_vpn:4.4.0.687:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
iobit	itop_vpn	4.4.0.687	cpe:2.3:a:iobit:itop_vpn:4.4.0.687:::::::*

CNA Affected

[
  {
    "vendor": "IObit",
    "product": "iTop Data Recovery Pro",
    "versions": [
      {
        "version": "4.4.0.687",
        "status": "affected"
      }
    ],
    "modules": [
      "BPL Handler"
    ]
  }
]

References

vuldb.com/?ctiid.273247

vuldb.com/?id.273247

vuldb.com/?submit.378138

CVSS2

6.8

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

EPSS

Percentile

16.2%

JSON

Related for CVE-2024-7324