CVE-2024-10438

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The eHRD CTMS from Sunnet has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to bypass authentication by satisfying specific conditions in order to access certain functionalities.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-288

Affected software

Vendor	Product	Versions
Sunnet	eHRD CTMS	< 10.14
sunnet	ehrd_ctms	< 10.14

References

https://www.twcert.org.tw/en/cp-139-8165-7da2f-2.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-8164-fe7c5-1.htmlThird Party Advisory

Timeline

Published: Oct 28, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-104397.5The eHRD CTMS from Sunnet has an Insecure Direct Object Reference (IDOR) vulnerability, allowing unauthenticated remote attackers to modify CVE-2024-10445.3The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che CVE-2024-104409.8The eHDR CTMS from Sunnet has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL command to re CVE-2024-104419.8Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synol CVE-2024-1044210.0Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 a CVE-2024-104439.8Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synolo CVE-2024-104447.5Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-CVE-2024-104455.3Improper certificate validation vulnerability in the update functionality in Synology BeeStation OS (BSM) before 1.1-65374 and Synology Disk CVE-2024-104467.2A vulnerability classified as critical has been found in Project Worlds Online Time Table Generator 1.0. Affected is an unknown function of CVE-2024-104478.8A vulnerability classified as critical was found in Project Worlds Online Time Table Generator 1.0. Affected by this vulnerability is an unk CVE-2024-104486.5A vulnerability, which was classified as problematic, has been found in code-projects Blood Bank Management System 1.0. Affected by this iss CVE-2024-104499.8A vulnerability, which was classified as critical, was found in Codezips Hospital Appointment System 1.0. This affects an unknown part of th