CVE-2024-6893

high · 7.5

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources.

7.5

CVSS

32.9%

EPSS (exploit prob.)

98th

EPSS percentile

2024-08-08

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-611

Affected products

Vendor	Product	Affected versions
journyx	journyx	11.5.4

Check a specific version with /api/v1/cve/match.

References

https://korelogic.com/Resources/Advisories/KL-001-2024-010.txt
http://seclists.org/fulldisclosure/2024/Aug/8

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-6893