{"id":"CVE-2024-8778","aliases":["EUVD-2024-49410","GHSA-g766-f3jj-h73r"],"status":"published","title":"The SYSCOM Group OMFLOW - Arbitrary File Read","description":"OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality, allowing remote attackers with regular privileges to read arbitrary system files.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00599,"percentile":0.48975,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22","CWE-36"],"published":"2024-09-16T05:48:33Z","modified":"2026-06-17T08:23:17Z","products":[{"vendor":"syscomgo","product":"omflow"},{"vendor":"the syscom group","product":"omflow"}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-8073-ff771-1.html","tags":["third-party-advisory","Third Party Advisory"]},{"url":"https://www.twcert.org.tw/en/cp-139-8074-66457-2.html","tags":["third-party-advisory","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8778"},{"url":"https://github.com/advisories/GHSA-g766-f3jj-h73r"}],"sources":{"cve":[{"id":"CVE-2024-8778","title":"The SYSCOM Group OMFLOW - Arbitrary File Read","description":"OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality, allowing remote attackers with regular privileges to read arbitrary system files.","status":"published","published":"2024-09-16T05:48:33.163Z","modified":"2024-09-16T13:05:51.023Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-36"],"updated_at":"2026-11-02T14:34:09.216761Z"}],"euvd":[{"id":"EUVD-2024-49410","description":"OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality, allowing remote attackers with regular privileges to read arbitrary system files.","status":"published","published":"2024-09-16T05:48:33Z","modified":"2024-09-16T13:05:51Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:55:55.02611Z"}],"ghsa":[{"id":"GHSA-g766-f3jj-h73r","title":"OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality,...","description":"OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality, allowing remote attackers with regular privileges to read arbitrary system files.","status":"published","published":"2024-09-16T14:37:28Z","modified":"2024-09-20T15:30:37Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-22","CWE-36"],"updated_at":"2026-11-02T14:58:18.610136Z"}],"nvd":[{"id":"CVE-2024-8778","description":"OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality, allowing remote attackers with regular privileges to read arbitrary system files.","status":"published","published":"2024-09-16T06:15:11.777Z","modified":"2026-06-17T08:23:17.25Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-36","CWE-22"],"updated_at":"2026-11-02T14:10:26.717759Z"}]}}