CVE-2024-3775: aEnrich Technology a+HRD - Argument Injection

Published Apr 15, 2024

Updated

aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitrary arguments to youtube-dl.exe, leading to the download of partial unauthorized files.

Affected Software

6 affected components

aEnrich Technology a+HRD

youtube-dl youtube-dl.exe

aEnrich A\+hrd=6.8

aEnrich A\+hrd=7.0

aEnrich A\+hrd=7.1

aEnrich A\+hrd=7.2

Remediation

Information

Update to eHRD 6.8.1039V1055 or later version Update to eHRD 7.0.1141V422 or later version Update to eHRD 7.1.1033V429 or later version Update to eHRD 7.2.1061V36 or later version

Event History

Apr 15, 2024

CVE Published

via MITRE·02:41 AM

Data Sourced

via MITRE·02:41 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:15 AM

DescriptionSeverityWeakness

Sep 17, 56274

Event

via FIRST·04:29 AM

Frequently Asked Questions

What is the severity of CVE-2024-3775?

CVE-2024-3775 has a medium severity due to the potential for unauthorized file downloads.

How do I fix CVE-2024-3775?

To fix CVE-2024-3775, ensure user input for file downloads using youtube-dl.exe is properly validated and sanitized.

Who is affected by CVE-2024-3775?

CVE-2024-3775 affects users of aEnrich Technology a+HRD that utilize the youtube-dl.exe functionality.

What are the potential impacts of CVE-2024-3775?

The potential impacts of CVE-2024-3775 include unauthorized access to files and potential data leakage.

Is CVE-2024-3775 a known security risk?

Yes, CVE-2024-3775 is recognized as a security risk due to its ability to compromise file integrity.