CVE-2024-23317

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

External Control of File Name or Path (CWE-73) in the Controller 6000 and Controller 7000 allows an attacker with local access to the Controller to perform arbitrary code execution.

This issue affects: 9.10 prior to vCR9.10.240520a (distributed in 9.10.1268(MR1)), 9.00 prior to vCR9.00.240521a (distributed in 9.00.1990(MR3)), 8.90 prior to vCR8.90.240520a (distributed in 8.90.1947 (MR4)), 8.80 prior to vCR8.80.240520a (distributed in 8.80.1726 (MR5)), 8.70 prior to vCR8.70.240520a (distributed in 8.70.2824 (MR7)), all versions of 8.60 and prior.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-73

Affected software

No affected versions have been published.

Timeline

Published: Jul 11, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-233193.5Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message that would disconnect a CVE-2024-23327.2A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been rated as critical. This issue affects some unkno CVE-2024-233208.8Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be CVE-2024-233218.8For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized act CVE-2024-233227.5Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen within the same interval. The crash occ CVE-2024-233235.3Envoy is a high-performance edge/middle/service proxy. The regex expression is compiled for every request and can result in high CPU usage a CVE-2024-233247.5Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients CVE-2024-233257.5Envoy is a high-performance edge/middle/service proxy. Envoy crashes in Proxy protocol when using an address type that isn’t supported by th CVE-2024-233268.2Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server CVE-2024-233277.5Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance wi CVE-2024-233289.1Dataease is an open source data visualization analysis tool. A deserialization vulnerability exists in the DataEase datasource, which can be CVE-2024-233293.7changedetection.io is an open source tool designed to monitor websites for content changes. In affected versions the API endpoint `/api/v1/w