Search criteria
1 vulnerability by 12dsynergy
CVE-2024-24722 (GCVE-0-2024-24722)
Vulnerability from cvelistv5 – Published: 2024-02-19 00:00 – Updated: 2025-03-25 15:51
VLAI
Summary
An unquoted service path vulnerability in the 12d Synergy Server and File Replication Server components may allow an attacker to gain elevated privileges via the 12d Synergy Server and/or 12d Synergy File Replication Server executable service path. This is fixed in 4.3.10.192, 5.1.5.221, and 5.1.6.235.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- n/a
- CWE-428 - Unquoted Search Path or Element
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| 12dsynergy | 12d_synergy_server |
Affected:
0 , < 4.3.10.192
(custom)
Affected: 0 , < 5.1.5.221 (custom) Affected: 0 , < 5.1.6.235 (custom) cpe:2.3:a:12dsynergy:12d_synergy_server:*:*:*:*:*:*:*:* |
|
| 12dsynergy | 12d_synergy_file_replication_server |
Affected:
0 , < 4.3.10.192
(custom)
Affected: 0 , < 5.1.5.221 (custom) Affected: 0 , < 5.1.6.235 (custom) cpe:2.3:a:12dsynergy:12d_synergy_file_replication_server:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:28:11.890Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.12dsynergy.com/security-statement/"
},
{
"tags": [
"x_transferred"
],
"url": "https://files.12dsynergy.com/downloads/download.aspx"
},
{
"tags": [
"x_transferred"
],
"url": "https://help.12dsynergy.com/v1/docs/cve-2024-24722"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:12dsynergy:12d_synergy_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "12d_synergy_server",
"vendor": "12dsynergy",
"versions": [
{
"lessThan": "4.3.10.192",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.1.5.221",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.1.6.235",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:12dsynergy:12d_synergy_file_replication_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "12d_synergy_file_replication_server",
"vendor": "12dsynergy",
"versions": [
{
"lessThan": "4.3.10.192",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.1.5.221",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.1.6.235",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-24722",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-25T15:51:52.455219Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-428",
"description": "CWE-428 Unquoted Search Path or Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-25T15:51:57.962Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An unquoted service path vulnerability in the 12d Synergy Server and File Replication Server components may allow an attacker to gain elevated privileges via the 12d Synergy Server and/or 12d Synergy File Replication Server executable service path. This is fixed in 4.3.10.192, 5.1.5.221, and 5.1.6.235."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-19T06:01:56.580Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.12dsynergy.com/security-statement/"
},
{
"url": "https://files.12dsynergy.com/downloads/download.aspx"
},
{
"url": "https://help.12dsynergy.com/v1/docs/cve-2024-24722"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-24722",
"datePublished": "2024-02-19T00:00:00.000Z",
"dateReserved": "2024-01-27T00:00:00.000Z",
"dateUpdated": "2025-03-25T15:51:57.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}