Source: Ministry of education information & communication security contingency platform
| Publication Number | TACERT-ANA-2024101809102525 | Publication Time | 2024/10/18 09:43 |
| Incident Type | ANA-Vulnerability Alert | Discovery Time | 2024/10/16 09:43 |
| Impact Level | Medium | ||
| [Subject] 【Vulnerability Alert】 Teamplus Technology Team+ Enterprise Private Cloud Communication and Collaboration Platform - SQL Injection |
|||
| [Content] Forwarded from TWCERTCC-200-202410-00000003 TWCERT/CC released TVN-202410004, CVE-2024-9924 (CVSS: 9.8 Critical) on 2024-10-14. Due to the incomplete patch for the CVE-2024-26261 vulnerability, certain packages of hgiga OAKlouds still pose risks. Unauthorized remote attackers can download arbitrary system files, and there is a possibility that these files may be deleted after download. Information Sharing Level: WHITE (Information content can be publicly disclosed) |
|||
| [Affected Platform] ● OAKlouds-webbase-2.0 versions prior to 1162 (exclusive) ● OAKlouds-webbase-3.0 versions prior to 1162 (exclusive) |
|||
| [Recommended Actions] 1.Update OAKlouds-webbase-2.0 to version 1162 (inclusive) or later. 2.Update OAKlouds-webbase-3.0 to version 1162 (inclusive) or later. |
|||
| [Reference] hgiga OAKlouds - Arbitrary File Read And Delete:https://www.twcert.org.tw/tw/cp-132-8130-89bb1-1.html |
|||