CVE-2024-11071: Improper Access Control In DestinyECM

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-07 · updated 2026-06-17
Weakness: CWE-352

Description

Permissive Cross-domain Policy with Untrusted Domains vulnerability in local API server of DestinyECM solution(versions described below) which is developed and maintained by Cyberdigm may allow Cross-Site Request Forgery (CSRF) attack, which probabilistically enables JSON Hijacking (aka JavaScript Hijacking) via forgery web page.* Due to product customization, version information may differ from the following version description. For further inquiries, please contact the vendor.

Affected products

Cyberdigm DestinyECM: from 5.24.10.* before 5.24.10.2303; from 5.23.10.* before 5.23.12.2450; from 5.23.02.* before 5.23.08.2451; from 5.22.* before 5.22.12.2446; from 5.21.*, 5.20.*, 5.19.* before 5.21.12.2303 — fixed in 5.21.12.2303, 5.22.12.2446, 5.23.08.2451, 5.23.12.2450, 5.24.10.2303

How to fix

Upgrade to a fixed version: Cyberdigm DestinyECM 5.21.12.2303, 5.22.12.2446, 5.23.08.2451, 5.23.12.2450. Check the vendor advisory for mitigations.

References

https://cyberdigm.co.kr/destinyEcm

Get alerted when CVE-2024-11071 or the next vulnerability affects your stack