CVE-2024-10173

A vulnerability has been found in didi DDMQ 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Console Module. The manipulation with the input /;login leads to improper authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.
References
Link Resource
https://github.com/didi/DDMQ/issues/37 Exploit Issue Tracking Third Party Advisory
https://github.com/didi/DDMQ/issues/37#issue-2577905007 Exploit Issue Tracking Third Party Advisory
https://vuldb.com/?ctiid.280957 Permissions Required Third Party Advisory VDB Entry
https://vuldb.com/?id.280957 Third Party Advisory VDB Entry
https://vuldb.com/?submit.421516 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:didiglobal:ddmq:*:*:*:*:*:*:*:*

History

22 Oct 2024, 17:05

Type Values Removed Values Added
References () https://github.com/didi/DDMQ/issues/37 - () https://github.com/didi/DDMQ/issues/37 - Exploit, Issue Tracking, Third Party Advisory
References () https://github.com/didi/DDMQ/issues/37#issue-2577905007 - () https://github.com/didi/DDMQ/issues/37#issue-2577905007 - Exploit, Issue Tracking, Third Party Advisory
References () https://vuldb.com/?ctiid.280957 - () https://vuldb.com/?ctiid.280957 - Permissions Required, Third Party Advisory, VDB Entry
References () https://vuldb.com/?id.280957 - () https://vuldb.com/?id.280957 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.421516 - () https://vuldb.com/?submit.421516 - Third Party Advisory, VDB Entry
CVSS v2 : 7.5
v3 : 7.3
v2 : 7.5
v3 : 7.5
CWE CWE-863
CPE cpe:2.3:a:didiglobal:ddmq:*:*:*:*:*:*:*:*
First Time Didiglobal ddmq
Didiglobal

21 Oct 2024, 17:09

Type Values Removed Values Added
Summary
  • (es) Se ha encontrado una vulnerabilidad en didi DDMQ 1.0 y se ha clasificado como crítica. Esta vulnerabilidad afecta a una funcionalidad desconocida del componente Console Module. La manipulación de la entrada /;login provoca una autenticación incorrecta. El ataque se puede lanzar de forma remota. La vulnerabilidad se ha divulgado al público y puede utilizarse. Este producto adopta el enfoque de lanzamientos continuos para proporcionar una entrega continua. Por lo tanto, no están disponibles los detalles de las versiones afectadas y actualizadas. Se contactó al proveedor con anticipación sobre esta divulgación, pero no respondió de ninguna manera.

20 Oct 2024, 05:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-10-20 05:15

Updated : 2024-10-22 17:05


NVD link : CVE-2024-10173

Mitre link : CVE-2024-10173

CVE.ORG link : CVE-2024-10173


JSON object : View

Products Affected

didiglobal

  • ddmq
CWE
CWE-863

Incorrect Authorization

CWE-287

Improper Authentication