CVE-2024-3706 - CVE House

Status published Medium CVE-2024-3706

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in OpenGnsys

5.9 CVSS

Vulnerability Description

Information exposure vulnerability in OpenGnsys affecting version 1.1.1d (Espeto). This vulnerability allows an attacker to view a php backup file (controlaccess.php-LAST) where database credentials are stored.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-3706

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Pedro Gabaldón Julá
Javier Medina Munuera
Antonio José Gálvez Sánchez

References

More from OpenGnsys

View All →

CVE-2024-3707

Exposure of Information Through Directory Listing vulnerability in OpenGnsys

Medium 5.3

CVE-2024-3705

Unrestricted Upload of File with Dangerous Type vulnerability in OpenGnsys

High 8.8

CVE-2024-3704

SQL Injection vulnerability in OpenGnsys

Critical 9.8

Affected Vendor

OpenGnsys

View all reports →

Affected Software

OpenGnsys

Vulnerable Versions:

1.1.1d

Timeline

Official Publish: April 12th, 2024

Last Modified: August 1st, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories

Collection

T1005 Data from Local System