CVE-2024-39341
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Entrust Instant Financial Issuance（Entrust Cardwizard）是美国Entrust公司的一个即时金融卡发行解决方案。 Entrust Instant Financial Issuance存在安全漏洞，该漏洞源于安装后留下的配置文件（WebAPI.cfg.xml）未进行适当的访问控制，导致潜在的敏感信息泄露。受影响版本如下：6.10.0、6.9.0、6.9.1、6.9.2、6.8.x及之前版本。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-39341
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Entrust Instant Financial Issuance (On Premise) Software (formerly known as Cardwizard) 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier leaves behind a configuration file (i.e. WebAPI.cfg.xml) after the installation process. This file can be accessed without authentication on HTTP port 80 by guessing the correct IIS webroot path. It includes system configuration parameter names and values with sensitive configuration values encrypted.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Entrust Instant Financial Issuance 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Entrust Instant Financial Issuance（Entrust Cardwizard）是美国Entrust公司的一个即时金融卡发行解决方案。 Entrust Instant Financial Issuance存在安全漏洞，该漏洞源于安装后留下的配置文件（WebAPI.cfg.xml）未进行适当的访问控制，导致潜在的敏感信息泄露。受影响版本如下：6.10.0、6.9.0、6.9.1、6.9.2、6.8.x及之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2024-39341
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-39341
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-39341 (1)
Same Patch Batch · n/a · 2024-09-23 · 16 CVEs total
| CVE-2024-41228 | Aliyun Container Service pouch Container 安全漏洞 | |
| CVE-2024-46241 | PHPGurukul Dairy Farm Shop Management System 安全漏洞 | |
| CVE-2024-34331 | Parallels Desktop Mac 安全漏洞 | |
| CVE-2024-47227 | iRedAdmin 安全漏洞 | |
| CVE-2024-39842 | Centreon 安全漏洞 | |
| CVE-2024-39342 | Entrust Instant Financial Issuance 安全漏洞 | |
| CVE-2024-39843 | Centreon 安全漏洞 | |
| CVE-2024-37779 | WoodWing Elvis DAM 安全漏洞 | |
| CVE-2024-44540 | Ubiquiti AirMax 安全漏洞 | |
| CVE-2024-40441 | Doccano 安全漏洞 | |
| CVE-2024-40442 | Doccano 安全漏洞 | |
| CVE-2024-46639 | HelpDeskZ 安全漏洞 | |
| CVE-2024-47222 | New Cloud MyOffice SDK Collaborative Editing Server 安全漏洞 | |
| CVE-2024-42861 | IEEE 802.1AS 安全漏洞 | |
| CVE-2023-46948 | Temenos T24 安全漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2024-39341
No comments yet