Description

CVE-2024-10613 is a critical vulnerability in ESAFENET CDG 5, affecting the delSystemEncryptPolicy function in the /com/esafenet/servlet/system/SystemEncryptPolicyService.java file. It allows remote attackers to execute SQL injection attacks by manipulating the id argument. The vulnerability has been publicly disclosed and may be actively exploited.

Key Insights

• High Severity: The SVRS score of 69 indicates a high level of severity, highlighting the urgency of addressing this vulnerability.
• SQL Injection Risk: The vulnerability allows attackers to inject malicious SQL queries into the application, potentially leading to data theft, unauthorized access, or system compromise.
• Remote Exploitability: The vulnerability can be exploited remotely, making it easier for attackers to target vulnerable systems.
• Public Disclosure: The vulnerability has been publicly disclosed, increasing the likelihood of exploitation.

Mitigation Strategies

• Apply Software Updates: Install the latest software updates from the vendor to patch the vulnerability.
• Implement Input Validation: Validate user input to prevent malicious SQL queries from being executed.
• Use SQL Injection Prevention Tools: Deploy tools that detect and block SQL injection attempts.
• Monitor Network Traffic: Monitor network traffic for suspicious activity that may indicate exploitation attempts.

Additional Information

• Threat Actors/APT Groups: No specific threat actors or APT groups have been identified as actively exploiting this vulnerability.
• Exploit Status: Active exploits have been published.
• CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has not issued a warning for this vulnerability.
• In the Wild: There is no evidence that this vulnerability is currently being exploited in the wild.

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.