Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2024-11071

Improper Access Control In DestinyECM

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
FSI

Description

Permissive Cross-domain Policy with Untrusted Domains vulnerability in local API server of DestinyECM solution(versions described below) which is developed and maintained by Cyberdigm may allow Cross-Site Request Forgery (CSRF) attack, which probabilistically enables JSON Hijacking (aka JavaScript Hijacking) via forgery web page.* Due to product customization, version information may differ from the following version description. For further inquiries, please contact the vendor.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cyberdigm DestinyECM

Default version status: unaffected

  • 5.24.10.* to < 5.24.10.2303affected
  • 5.23.10.* to < 5.23.12.2450affected
  • 5.23.02.* to < 5.23.08.2451affected
  • 5.22.* to < 5.22.12.2446affected
  • 5.21.*, 5.20.*, 5.19.* to < 5.21.12.2303affected

References