Read the docs
TI-2024-10259 Aliases CVE-2024-11071GHSA-hmr2-jqqv-r579

Improper Access Control In DestinyECM

Priority LOW 35CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

Permissive Cross-domain Policy with Untrusted Domains vulnerability in local API server of DestinyECM solution(versions described below) which is developed and maintained by Cyberdigm may allow Cross-Site Request Forgery (CSRF) attack, which probabilistically enables JSON Hijacking (aka JavaScript Hijacking) via forgery web page.* Due to product customization, version information may differ from the following version description. For further inquiries, please contact the vendor.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00204 10th percentileScored 2026-11-07
Fix Fixed DestinyECM (Cyberdigm): 5.24.10.2303, 5.23.12.2450, 5.23.08.2451 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CyberdigmDestinyECMbefore 5.24.10.2303; before 5.23.12.2450; before 5.23.08.2451; before 5.22.12.2446; before 5.21.12.23035.24.10.2303, 5.23.12.2450, 5.23.08.2451, 5.22.12.2446, 5.21.12.2303Patch availableCNA
  • DestinyECM VendorCyberdigm Affected before 5.24.10.2303; before 5.23.12.2450; before 5.23.08.2451; before 5.22.12.2446; before 5.21.12.2303 Fixed in 5.24.10.2303, 5.23.12.2450, 5.23.08.2451, 5.22.12.2446, 5.21.12.2303 Patch available CNA

Remediation

  • Fix · CNA DestinyECM (Cyberdigm) Fixed in 5.24.10.2303, 5.23.12.2450, 5.23.08.2451, 5.22.12.2446, 5.21.12.2303

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-11071
  2. 2026-10-03 Alias added: GHSA-hmr2-jqqv-r579

References

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences