CVE-2024-38295
Published: 13 June 2024
Summary
CVE-2024-38295 is a critical-severity an unspecified weakness vulnerability in Alcasar Alcasar. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 8.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
ALCASAR versions prior to 3.6.1 contain a remote code execution vulnerability in the still_connected.php component. The flaw received a CVSS 3.1 base score of 9.8, reflecting network attack vector, low complexity, and no requirements for authentication or user interaction, with high impact on confidentiality, integrity, and availability.
An unauthenticated attacker with network access can exploit the issue to execute arbitrary commands on the affected server, resulting in complete system compromise. Because the vulnerability is reachable without credentials, it can be targeted by any remote party able to reach the ALCASAR instance.
The referenced changelog and distribution files indicate that the flaw is resolved in release 3.6.1; administrators are therefore advised to upgrade immediately from the project site or package repository. The associated EPSS score has remained flat at 0.0676 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-37252
Vulnerability details
ALCASAR before 3.6.1 allows still_connected.php remote code execution.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.