CVE-2024-11071

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Permissive Cross-domain Policy with Untrusted Domains vulnerability in local API server of DestinyECM solution(versions described below) which is developed and maintained by Cyberdigm may allow Cross-Site Request Forgery (CSRF) attack, which probabilistically enables JSON Hijacking (aka JavaScript Hijacking) via forgery web page.* Due to product customization, version information may differ from the following version description. For further inquiries, please contact the vendor.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352 CWE-942

Affected software

Vendor	Product	Versions
Cyberdigm	DestinyECM	>= 5.24.10., < 5.24.10.2303; >= 5.23.10., < 5.23.12.2450; >= 5.23.02., < 5.23.08.2451; >= 5.22., < 5.22.12.2446; >= 5.21., 5.20., 5.19.*, < 5.21.12.2303

References

https://cyberdigm.co.kr/destinyEcm

Timeline

Published: Apr 7, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-110738.1A vulnerability classified as problematic has been found in SourceCodester Hospital Management System 1.0. This affects an unknown part of t CVE-2024-110749.8A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. This vulnerability affects unknown code of CVE-2024-110758.8A vulnerability in the Incoming Goods Suite allows a user with unprivileged access to the underlying system (e.g. local or via SSH) a privil CVE-2024-110769.8A vulnerability, which was classified as critical, has been found in code-projects Job Recruitment 1.0. This issue affects some unknown proc CVE-2024-110779.8A vulnerability, which was classified as critical, was found in code-projects Job Recruitment 1.0. Affected is an unknown function of the fi CVE-2024-110785.4A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as problematic. Affected by this vulnerability is an unkn CVE-2024-110795.5A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to refe CVE-2024-11088.2The Plugin Groups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_ini CVE-2024-110809.8The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to CVE-2024-110829.9The Tumult Hype Animations plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the hypeanima CVE-2024-110835.3The ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.15.18 via the CVE-2024-110846.3Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whether a username exist