【Vulnerability Alert】 hgiga OAKlouds - Arbitrary File Read And Delete

publish date : 2024-10-22 update date : 2024-10-22

Source: Ministry of education information & communication security contingency platform


Publication Number	TACERT-ANA-2024101809102525	Publication Time	2024/10/18 09:43
Incident Type	ANA-Vulnerability Alert	Discovery Time	2024/10/16 09:43
Impact Level	Medium
[Subject] 【Vulnerability Alert】 Teamplus Technology Team+ Enterprise Private Cloud Communication and Collaboration Platform - SQL Injection
[Content] Forwarded from TWCERTCC-200-202410-00000003 TWCERT/CC released TVN-202410004, CVE-2024-9924 (CVSS: 9.8 Critical) on 2024-10-14. Due to the incomplete patch for the CVE-2024-26261 vulnerability, certain packages of hgiga OAKlouds still pose risks. Unauthorized remote attackers can download arbitrary system files, and there is a possibility that these files may be deleted after download. Information Sharing Level: WHITE (Information content can be publicly disclosed)
[Affected Platform] ● OAKlouds-webbase-2.0 versions prior to 1162 (exclusive) ● OAKlouds-webbase-3.0 versions prior to 1162 (exclusive)
[Recommended Actions] 1.Update OAKlouds-webbase-2.0 to version 1162 (inclusive) or later. 2.Update OAKlouds-webbase-3.0 to version 1162 (inclusive) or later.
[Reference] hgiga OAKlouds - Arbitrary File Read And Delete:https://www.twcert.org.tw/tw/cp-132-8130-89bb1-1.html

(This notification is for informational purposes only and does not constitute a cybersecurity incident).
If you have questions or suggestions regarding this notification, please feel free to contact us.
Ministry of education information & communication security contingency platform
Website: https://info.cert.tanet.edu.tw/
Phone: +886-7-5250211
Internet Phone: 98400000
E-Mail: service@cert.tanet.edu.tw

Organizer: Computer Center

Click Num:

Share