CVE-2024-6738 WisdomGarden Tronclass - Broken Access Control
Unauthenticated attackers can access specific files via the thumbnail API due to missing access controls in WisdomGarden Tronclass.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-6738?
CVE-2024-6738 is a medium-severity missing authorization vulnerability in WisdomGarden Tronclass, published on 15 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The tumbnail API of Tronclass from WisdomGarden lacks proper access control, allowing unauthenticated remote attackers to obtain certain specific files by modifying the URL.
Weakness: CWE-284
Which versions are affected by CVE-2024-6738?
It affects 1 product.
Products include Wisdomgarden Tronclass.
How do I fix CVE-2024-6738?
No fix has been published for CVE-2024-6738 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-6738 being exploited?
There is no known exploitation of CVE-2024-6738 in the wild and no public exploit code.
Sources
Also known as GHSA-6phm-74mw-7r5r.