CVE-2024-13061
Critical
Description
The Electronic Official Document Management System from 2100 Technology has an Authentication Bypass vulnerability. Although the product enforces an IP whitelist for the API used to query user tokens, unauthenticated remote attackers can still deceive the server to obtain tokens of arbitrary users, which can then be used to log into the system.
SeverityCritical
CVSS9.8
Exploit probability—
ProductOfficial Document Management System
PublishedDec 31, 2024
First seenDec 31, 2024
Weakness typeCWE-290CWE-290
How to fix
Update
- 2100 Technology Electronic Official Document Management System5.0.86.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| 2100 Technology Electronic Official Document Management System | v < 5.0.86.9 | 5.0.86.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.