CVE-2024-0949
Improper Access Control in Talya Informatics' Elektraweb
Description
Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows Authentication Bypass. This issue affects Elektraweb: before v17.0.68.
INFO
Published Date :
June 27, 2024, 10:15 a.m.
Last Modified :
June 17, 2026, 6:54 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | CRITICAL | [email protected] |
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-0949.
| URL | Resource |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-0808 | |
| https://www.usom.gov.tr/bildirim/tr-24-0808 | |
| https://www.usom.gov.tr/bildirim/tr-24-0808 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-0949 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-0949
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-0949 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-0949 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'Talya Informatics', 'product': 'Elektraweb', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'v17.0.68', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:2.3:a:talya_informatics:elektraweb:*:*:*:*:*:*:*:*'], 'vendor': 'talya_informatics', 'product': 'elektraweb', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': 'v17.0.68', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}] Added SSVC {'id': 'CVE-2024-0949', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2024-07-24T13:32:07.238546Z'} -
CVE Modified by [email protected]
Jun. 03, 2026
Action Type Old Value New Value Changed Description Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows Authentication Bypass.This issue affects Elektraweb: before v17.0.68. Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows Authentication Bypass. This issue affects Elektraweb: before v17.0.68. Added Reference https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-0808 -
CVE Modified by [email protected]
Oct. 14, 2025
Action Type Old Value New Value Changed Description Improper Access Control, Missing Authorization, Incorrect Authorization, Incorrect Permission Assignment for Critical Resource, Missing Authentication, Weak Authentication, Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Talya Informatics Elektraweb allows Exploiting Incorrectly Configured Access Control Security Levels, Manipulating Web Input to File System Calls, Embedding Scripts within Scripts, Malicious Logic Insertion, Modification of Windows Service Configuration, Malicious Root Certificate, Intent Spoof, WebView Exposure, Data Injected During Configuration, Incomplete Data Deletion in a Multi-Tenant Environment, Install New Service, Modify Existing Service, Install Rootkit, Replace File Extension Handlers, Replace Trusted Executable, Modify Shared File, Add Malicious File to Shared Webroot, Run Software at Logon, Disable Security Software.This issue affects Elektraweb: before v17.0.68. Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows Authentication Bypass.This issue affects Elektraweb: before v17.0.68. Added CWE CWE-798 Added CWE CWE-552 Removed CWE CWE-284 Removed CWE CWE-732 Removed CWE CWE-862 Removed CWE CWE-863 Removed CWE CWE-923 Removed CWE CWE-1390 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://www.usom.gov.tr/bildirim/tr-24-0808 -
CVE Received by [email protected]
Jun. 27, 2024
Action Type Old Value New Value Added Description Improper Access Control, Missing Authorization, Incorrect Authorization, Incorrect Permission Assignment for Critical Resource, Missing Authentication, Weak Authentication, Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Talya Informatics Elektraweb allows Exploiting Incorrectly Configured Access Control Security Levels, Manipulating Web Input to File System Calls, Embedding Scripts within Scripts, Malicious Logic Insertion, Modification of Windows Service Configuration, Malicious Root Certificate, Intent Spoof, WebView Exposure, Data Injected During Configuration, Incomplete Data Deletion in a Multi-Tenant Environment, Install New Service, Modify Existing Service, Install Rootkit, Replace File Extension Handlers, Replace Trusted Executable, Modify Shared File, Add Malicious File to Shared Webroot, Run Software at Logon, Disable Security Software.This issue affects Elektraweb: before v17.0.68. Added Reference Computer Emergency Response Team of the Republic of Turkey https://www.usom.gov.tr/bildirim/tr-24-0808 [No types assigned] Added CWE Computer Emergency Response Team of the Republic of Turkey CWE-863 Added CWE Computer Emergency Response Team of the Republic of Turkey CWE-306 Added CWE Computer Emergency Response Team of the Republic of Turkey CWE-284 Added CWE Computer Emergency Response Team of the Republic of Turkey CWE-862 Added CWE Computer Emergency Response Team of the Republic of Turkey CWE-732 Added CWE Computer Emergency Response Team of the Republic of Turkey CWE-1390 Added CWE Computer Emergency Response Team of the Republic of Turkey CWE-923 Added CVSS V3.1 Computer Emergency Response Team of the Republic of Turkey AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H