onethink 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
一般的な弱点パターンには vendor risk csrf、vendor risk sql injection, and vendor risk ssrf があり、vendor surface production workloads and vendor surface software deployment の利用場面で vendor impact data exposure などのリスクが生じる可能性があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2024-33443 | An issue in onethink v.1.1 allows a remote attacker to execute arbitrary code via a crafted script to the AddonsController.class.php component. | [email protected] | 7.1 | 0.70% | 2024-04-29 | 2025-04-16 |
| CVE-2024-33444 | SQL injection vulnerability in onethink v.1.1 allows a remote attacker to escalate privileges via a crafted script to the ModelModel.class.php component. | [email protected] | 9.8 | 0.90% | 2024-04-29 | 2025-04-16 |
| CVE-2018-16449 | OneThink 1.1.141212 allows CSRF for adding a page via admin.php?s=/Channel/add.html, adding a blog via admin.php?s=/Article/update.html, and setting the audit state via admin.php?s=/Article/setStatus/status/1.html. | [email protected] | 6.5 | 0.56% | 2018-09-04 | 2024-11-21 |
| CVE-2018-15198 | An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a user. | [email protected] | 8.8 | 0.65% | 2018-08-08 | 2024-11-21 |
| CVE-2018-15197 | An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/AuthManager/addToGroup.html that can endow administrator privileges. | [email protected] | 8.8 | 0.65% | 2018-08-08 | 2024-11-21 |
| CVE-2017-14323 | SSRF (Server Side Request Forgery) in getRemoteImage.php in Ueditor in Onethink V1.0 and V1.1 allows remote attackers to obtain sensitive information, attack intranet hosts, or possibly trigger remote command execution via the upfile parameter. | [email protected] | 9.8 | 4.48% | 2018-04-10 | 2024-11-21 |