CVE-2024-11071
High
Description
Permissive Cross-domain Policy with Untrusted Domains vulnerability in local API server of DestinyECM solution(versions described below) which is developed and maintained by Cyberdigm may allow Cross-Site Request Forgery (CSRF) attack, which probabilistically enables JSON Hijacking (aka JavaScript Hijacking) via forgery web page.* Due to product customization, version information may differ from the following version description. For further inquiries, please contact the vendor.
SeverityHigh
CVSS8.8
Exploit probability—
ProductDestinyECM
PublishedApr 7, 2025
First seenApr 7, 2025
How to fix
Update
- Cyberdigm DestinyECM5.24.10.2303, 5.23.12.2450, 5.23.08.2451, 5.22.12.2446, 5.21.12.2303 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Cyberdigm DestinyECM | 5.24.10.* ≤ v < 5.24.10.2303, 5.23.10.* ≤ v < 5.23.12.2450, 5.23.02.* ≤ v < 5.23.08.2451, 5.22.* ≤ v < 5.22.12.2446, 5.21.*, 5.20.*, 5.19.* ≤ v < 5.21.12.2303 | 5.24.10.2303, 5.23.12.2450, 5.23.08.2451, 5.22.12.2446, 5.21.12.2303 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.