CVE-2024-38886
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A vulnerability in Horizon Business Services Inc. Caterease versions 16.0.1.1663 through 24.0.1.2405 and possibly later allows a remote attacker to perform a Traffic Injection attack due to improper verification of the source of a communication channel.
Risk Assessment
An attacker can inject malicious traffic into the system's communication, potentially leading to data integrity compromise, impersonation of legitimate sources, or unauthorized operations.
Recommendation
Immediately update Caterease to the latest available version that includes a fix for this vulnerability. Until the update is applied, restrict system access to trusted networks and IP addresses only.
Other vulnerabilities in Caterease
See all- CVE-2024-38887Critical
A vulnerability in Horizon Business Services Inc. Caterease versions 16.0.1.1663 through 24.0.1.2405 and possibly later allows a remote attacker to expand control over the operating system from the database due to execution of commands with unnecessary privileges.
- CVE-2024-38889Critical
SQL Injection vulnerability in Horizon Business Services Inc. Caterease versions 16.0.1.1663 through 24.0.1.2405 and possibly later. A remote attacker can inject malicious SQL commands due to improper neutralization of special elements used in SQL commands.
- CVE-2024-38883Critical
A vulnerability in Horizon Business Services Inc. Caterease allows a remote attacker to perform a Drop Encryption Level attack by selecting a less-secure algorithm during negotiation. Affected versions range from 16.0.1.1663 to 24.0.1.2405 and possibly later.
- CVE-2024-38882Critical
A vulnerability in Horizon Business Services Inc. Caterease versions 16.0.1.1663 through 24.0.1.2405 (and possibly later) allows a remote attacker to execute operating system commands via SQL injection. The issue stems from improper neutralization of special elements used in OS commands.
- CVE-2024-38891High
A vulnerability in Horizon Business Services Inc. Caterease allows a remote attacker to perform network traffic sniffing due to cleartext transmission of sensitive information. Affected versions range from 16.0.1.1663 through 24.0.1.2405 and possibly later.
- CVE-2024-38888Medium
A vulnerability in Horizon Business Services Inc. Caterease versions 16.0.1.1663 through 24.0.1.2405 and possibly later allows a local attacker to perform a password brute force attack due to improper restriction of excessive authentication attempts.
- CVE-2024-38885High
A vulnerability in Horizon Business Services Inc. Caterease allows a remote attacker to gain unauthorized access using known operating system credentials due to hardcoded SQL user credentials in the client application.
- CVE-2024-38884High
A vulnerability in Caterease allows a local attacker to bypass authentication mechanisms due to improperly implemented security checks. The issue affects versions 16.0.1.1663 through 24.0.1.2405 and possibly later versions.
- CVE-2024-38881High
A vulnerability in Caterease versions 16.0.1.1663 through 24.0.1.2405 (and possibly later) stores user passwords as one-way hashes without salts. This allows a remote attacker to perform a Rainbow Table password cracking attack to recover passwords.
Original NVD description (English source)
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Traffic Injection attack due to improper verification of the source of a communication channel.