CVE-2024-26261: Hgiga OAKlouds - Arbitrary File Read And Delete

Description

The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability. Attackers can put file path in specific request parameters, allowing them to download the file without login. Furthermore, the file will be deleted after being downloaded.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.7% · higher than 52% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

OA

OAKlouds · Hgiga

earlier before 188; earlier before 1051 · source: vendor

OA

Oaklouds-organization-2.0 · Hgiga

before 188 · source: NVD

OA

Oaklouds-organization-3.0 · Hgiga

before 188 · source: NVD

OA

Oaklouds-webbase-2.0 · Hgiga

before 1051 · source: NVD

OA

Oaklouds-webbase-3.0 · Hgiga

before 1051 · source: NVD

OA

Oaklouds-organization · Hgiga

before 188; before 188 · source: CISA

OA

Oaklouds-webbase · Hgiga

before 1051; before 1051 · source: CISA