CVE-2024-12642CWE-23CWE-352

Chunghwa Telecom TenderDocTransfer - Arbitrary File Write

High · published December 16, 2024

CVSS v3.1
8.1
EPSS
0%
Percentile
29.8
In the wild
Unconfirmed
What it is

TenderDocTransfer from Chunghwa Telecom has an Arbitrary File Write vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains a Relative Path Traversal vulnerability, allowing attackers to write arbitrary files to any path on the user's system.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00370 · 29.8th percentile
Weaknesses
CWE-23 · Relative Path Traversal; CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2024-12-16T06:30Z
EPSS history
Timeline
  • 16 DEC 06:30Z
    Chunghwa Telecom TenderDocTransfer - Arbitrary File Write
    cvelistv5