CVE-2024-27764

The vulnerability is classified as CWE-22 (path traversal) and CWE-27, indicating improper validation of paths in the AuthInterceptor component responsible for access control. An attacker can craft an HTTP request containing a properly constructed path that allows bypassing authorization mechanisms. As a result, it is possible to gain access to resources or functions reserved for privileged users without possessing valid credentials.

An unauthenticated attacker can remotely escalate their privileges in the system, leading to complete compromise of confidentiality, integrity, and availability of data processed by the Jeewms application.

Apply patches available from the vendor according to the references. It is recommended to update to a version higher than 3.7 and restrict access to the application interface from external networks until the fix is applied.

Jeewms version 3.7 and all earlier versions