CVE-2024-4300: E-WEBInformationCo. FS-EZViewer(Web) - Sensitive Data Exposure

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-29 · updated 2026-06-17
Weakness: CWE-200

Description

E-WEBInformationCo. FS-EZViewer(Web) exposes sensitive information in the service. A remote attacker can obtain the database configuration file path through the webpage source code without login. Accessing this path allows attacker to obtain the database credential with the highest privilege and database host IP address. With this information, attackers can connect to the database and perform actions such as adding, modifying, or deleting database contents.

Affected products

E-Webinformationco Fs-Ezviewer: through 10.4.0.0

References

https://www.twcert.org.tw/tw/cp-132-7774-fbd01-1.html
https://www.twcert.org.tw/tw/cp-132-7774-fbd01-1.html

Get alerted when CVE-2024-4300 or the next vulnerability affects your stack