CVE-2024-8395
Last modified
CVE-2024-8395 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. FlyCASS CASS and KCM systems did not correctly filter SQL queries, which made them vulnerable to attack by outside attackers with no authentication.. EPSS estimates a 0.74% chance of exploitation in the next 30 days.
Description
FlyCASS CASS and KCM systems did not correctly filter SQL queries, which made them vulnerable to attack by outside attackers with no authentication.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Flycass | Flycass | All versions |
References
- https://ian.sh/tsaExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-8395?
How severe is CVE-2024-8395?
How do I fix CVE-2024-8395?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-8388Multiple prompts and panels from both Firefox and the Androi…5.3
- CVE-2024-8389Memory safety bugs present in Firefox 129. Some of these bug…9.8
- CVE-2024-8391In Eclipse Vert.x version 4.3.0 to 4.5.9, the gRPC server do…7.5
- CVE-2024-8392The WordPress Post Grid Layouts with Pagination – Sogrid plu…7.2
- CVE-2024-8393The Woocommerce Blocks – Woolook plugin for WordPress is vul…6.6
- CVE-2024-8394When aborting the verification of an OTR chat session, an at…6.5
- CVE-2024-8397The webtoffee-gdpr-cookie-consent WordPress plugin before 2.…5.4
- CVE-2024-8398The Simple Nav Archives WordPress plugin through 2.1.3 does …4.3
- CVE-2024-8399Websites could utilize Javascript links to spoof URL address…4.7
- CVE-2024-8400A stored cross-site scripting (XSS) vulnerability exists in …5.4
- CVE-2024-8401CWE-79: Improper Neutralization of Input During Web Page Gen…5.4
- CVE-2024-8402An issue was discovered in GitLab EE affecting all versions …7.4
Are you affected by CVE-2024-8395?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST