CVE-2024-12642

Summary

CVE-2024-12642 is a vulnerability affecting the TenderDocTransfer application from Chunghwa Telecom. This issue involves a lack of Cross-Site Request Forgery (CSRF) protection in the APIs, which can be exploited by unauthenticated remote attackers through phishing. Furthermore, one of the APIs contains a Relative Path Traversal vulnerability, allowing attackers to write arbitrary files to any location on the user's system. By leveraging these vulnerabilities, an attacker could gain unauthorized access to sensitive information or even take control of the affected system.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.