CVE-2024-7921 Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 GetDataList access control

Medium 5.3 Published 19 Aug 2024 Updated 19 Aug 2024

Remote attackers can access parking records without proper authorization due to missing access controls in the JieLink+ system.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-7921?

CVE-2024-7921 is a medium-severity missing authorization vulnerability in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016, published on 19 Aug 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability has been found in Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 up to 20240805 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /report/ParkOutRecord/GetDataList. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Weakness: CWE-284

Which versions are affected by CVE-2024-7921?

It affects 1 product.

Products include Jielink\+ Jsotc2016 Project Jielink\+ Jsotc2016.

How do I fix CVE-2024-7921?

No fix has been published for CVE-2024-7921 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-7921 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-7921 exists.

Sources

Also known as GHSA-cc99-q527-fggw.