CVE-2024-38294
Published: 13 June 2024
Summary
CVE-2024-38294 is a critical-severity an unspecified weakness vulnerability in Alcasar Alcasar. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
ALCASAR versions prior to 3.6.1 contain a remote code execution vulnerability in the email_registration_back.php component. The flaw received a CVSS v3.1 score of 9.8 and is tracked without an associated CWE entry.
Unauthenticated attackers with network access can invoke the affected script to execute arbitrary commands on the underlying system. Successful exploitation grants full confidentiality, integrity, and availability impact, enabling complete compromise of the ALCASAR instance without user interaction.
The referenced CHANGELOG.md and project download pages document the release of version 3.6.1, which addresses the issue; administrators should apply the update to eliminate the vulnerable code path.
EPSS remains at 0.1273 with no material increase observed since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-37251
Vulnerability details
ALCASAR before 3.6.1 allows email_registration_back.php remote code execution.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.