CVE Feed

    Dashboard / CVE / CVE-2024-27605

    CVE-2024-27605

    Alldata V0.4.6 is vulnerable to Insecure Permissions. Using users (test) can query information about the users in the system.

    Published:Apr 2, 2024
    Last Modified:Mar 28, 2025
    EPS:Apr 2, 2024
    EPSS Score:0.00153
    CVSS Score:7.5

    Affected Products

    Vendor
    Alldata
    Product
    Alldata

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-284 Improper Access Control

    Related CVEs

    CVE-2026-19827 (CVSS 5.5) — A flaw has been found in alldatacenter alldata up to 0.6.8. This impacts the function FileInputStream of the f…
    CVE-2026-19826 (CVSS 5.5) — A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.rea…
    CVE-2024-27602 (CVSS 9.1) — Alldata V0.4.6 is vulnerable to Incorrect Access Control. A total of many modules interface documents have bee…
    CVE-2024-27604 (CVSS 9.8) — Alldata V0.4.6 is vulnerable to Command execution vulnerability. System commands can be deserialized.…
    CVE-2024-29432 (CVSS 9.8) — Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename parameter at /data/ma…
    CVE-2024-29434 (CVSS 8.3) — An issue in the system image upload interface of Alldata v0.4.6 allows attackers to execute a directory traver…
    CVE-2024-29433 (CVSS 9.8) — A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitr…
    CVE-2024-29435 (CVSS 4.1) — An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High