CVE-2024-49704: XEE
A vulnerability has been identified in COMOS V10.3 (All versions < V10.3.3.5.8), COMOS V10.4.0 (All versions), COMOS V10.4.1 (All versions), COMOS V10.4.2 (All versions), COMOS V10.4.3 (All versions < V10.4.3.0.47), COMOS V10.4.4 (All versions < V10.4.4.2), COMOS V10.4.4.1 (All versions < V10.4.4.1.21). The Generic Data Mapper, the Engineering Adapter, and the Engineering Interface improperly handle XML External Entity (XXE) entries when parsing configuration and mapping files. This could allow an attacker to extract any file with a known location on the user's system or accessible network folders by persuading a user to use a maliciously crafted configuration or mapping file in one of the affected components.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49704?
CVE-2024-49704 is classified as a high severity vulnerability that could potentially lead to significant impacts on the affected systems.
How do I fix CVE-2024-49704?
To remediate CVE-2024-49704, update your COMOS software to versions 10.3.3.5.8 or later for COMOS V10.3, and to versions 10.4.3.0.47 or later for COMOS V10.4.x.
Which versions of COMOS are affected by CVE-2024-49704?
All versions of COMOS prior to 10.3.3.5.8, and all versions of COMOS V10.4.0 through V10.4.4.1 below their respective patch levels are vulnerable.
Can CVE-2024-49704 be exploited remotely?
Yes, CVE-2024-49704 may be exploited remotely, which increases the urgency to apply security updates.
Are there any workarounds for CVE-2024-49704?
Currently, there are no documented workarounds for CVE-2024-49704; applying the updates is the recommended solution.