CVE-2024-9984
Ragic Enterprise Cloud Database - Missing Authentication
- State
- Published
- Severity
- 9.8 Critical
- Published
- Oct 15, 2024
- Updated
- Oct 15, 2024
- Reserved
- Oct 15, 2024
Description
Enterprise Cloud Database from Ragic does not authenticate access to specific functionality, allowing unauthenticated remote attackers to use this functionality to obtain any user's session cookie.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | twcert |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
Enterprise Cloud DatabaseRagic |
|
References
- https://www.twcert.org.tw/tw/cp-132-8150-c955a-1.htmlthird-party-advisory
- https://www.twcert.org.tw/en/cp-139-8151-1a4b5-2.htmlthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.