CVE-2024-24914

Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. A Security fix that mitigates this vulnerability is available.

Scoring

Severity

HIGH

CVSS base score

8

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS probability

0.41%

CWE

CWE-914

Published

2024-11-07

Last modified

2026-03-13

Affected products

• checkpoint ClusterXL, Multi-Domain Security Management, Quantum Appliances, Quantum Maestro, Quantum Scalable Chassis, Quantum Security Gateways, Quantum Security Management

Weakness type

• CWE-914

Related vulnerabilities

• CVE-2026-35173 — Chyrp Lite has an IDOR via Mass Assignment in Post Model
• CVE-2025-14085 — youlaitech youlai-mall orders improper control of dynamically-identified variables
• CVE-2025-14051 — youlaitech youlai-mall addresses deleteAddress improper control of dynamically-identified variables
• CVE-2024-54198 — Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP
• CVE-2023-33175 — ToUI allows user-specific variables to be shared between users

Markdown version · Browse all CVEs