CVE-2024-8780CWE-200

The SYSCOM Group OMFLOW - Improper Authorization for Data Query Function

Medium · published September 16, 2024

CVSS v3.1
6.5
EPSS
0%
Percentile
36.9
In the wild
Unconfirmed
What it is

OMFLOW from The SYSCOM Group does not properly restrict the query range of its data query functionality, allowing remote attackers with regular privileges to obtain accounts and password hashes of other users.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00436 · 36.9th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2024-09-16T05:56Z
EPSS history
Timeline
  • 16 SEP 05:56Z
    The SYSCOM Group OMFLOW - Improper Authorization for Data Query Function
    cvelistv5