CVE-2024-3774: aEnrich Technology a+HRD - Exposure of Sensitive Data

Published Apr 15, 2024

Updated

aEnrich Technology a+HRD's functionality for front-end retrieval of system configuration values lacks proper restrictions on a specific parameter, allowing attackers to modify this parameter to access certain sensitive system configuration values.

Affected Software

4 affected components

aEnrich A\+hrd=6.8

aEnrich A\+hrd=7.0

aEnrich A\+hrd=7.1

aEnrich A\+hrd=7.2

Remediation

Information

Update to eHRD to 6.8.1039V1055 or later version Update to eHRD to 7.0.1141V422 or later version Update to eHRD to 7.1.1033V429 or later version Update to eHRD to 7.2.1061V36 or later version

Event History

Apr 15, 2024

CVE Published

via MITRE·02:14 AM

Data Sourced

via MITRE·02:14 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:16 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-3774?

CVE-2024-3774 has a critical severity rating due to the potential for unauthorized access to sensitive system configuration values.

How do I fix CVE-2024-3774?

To fix CVE-2024-3774, implement proper input validation and parameter restrictions in the affected aEnrich A+HRD versions.

Which aEnrich A+HRD versions are affected by CVE-2024-3774?

CVE-2024-3774 affects aEnrich A+HRD versions 6.8, 7.0, 7.1, and 7.2.

What type of vulnerability is CVE-2024-3774?

CVE-2024-3774 is an access control vulnerability that allows attackers to read sensitive configuration data.

Can CVE-2024-3774 be exploited remotely?

Yes, CVE-2024-3774 can be exploited remotely if the system is not properly secured.