{"id":"CVE-2024-58406","kind":"vulnerability","aliases":["CVE-2024-58406"],"related":[],"title":"Huatian OA8000 office system lets unauthenticated visitors read server files","description":"Huatian Dynamic OA8000 collaborative office system contains an unauthenticated path traversal vulnerability in /OAapp/jsp/trace/ntkodownload.jsp, where the filename request parameter is used to locate a file without restricting access to an intended directory or rejecting traversal sequences. Attackers can supply ../ sequences to read arbitrary files from the server, such as the Tomcat configuration at ROOT/WEB-INF/web.xml, exposing sensitive configuration, source, and credential material that can enable further compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-11-20.","summary":"The Huatian Dynamic OA8000 collaborative office system has a path traversal flaw in its ntkodownload.jsp page, where the filename parameter accepts ../ sequences. An unauthenticated attacker can read arbitrary files from the server, including Tomcat configuration files that may hold credentials.","severity":"high","cvss":8.7,"epss":null,"exploited":true,"exploited_at":null,"products":[{"name":"Huatian Dynamic OA8000","fixed":[],"affected":"unspecified (VulnCheck lists <= unspecified)","ecosystem":"vendor"}],"ecosystems":[],"tags":["huatian","java","oa8000","other","path-traversal","self-hosted","tomcat","unauthenticated"],"not_affected_if":["not-oa8000"],"how_to_check":"Check whether /OAapp/jsp/trace/ntkodownload.jsp exists on your OA8000 server and whether a request with filename=../ sequences (for example toward ROOT/WEB-INF/web.xml) returns file contents without login. Affected version range is unspecified by the source.","fix":null,"status":"open","published_at":"2026-11-13T16:17:18+00:00","first_seen_at":"2026-11-13T16:47:32+00:00","triaged_at":"2026-11-13T16:48:18+00:00","updated_at":"2026-11-13T16:53:08+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T16:48:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Huatian OA8000 office system lets unauthenticated visitors read server files","impact":"medium","summary":"The Huatian Dynamic OA8000 collaborative office system has a path traversal flaw in its ntkodownload.jsp page, where the filename parameter accepts ../ sequences. An unauthenticated attacker can read arbitrary files from the server, including Tomcat configuration files that may hold credentials.","audience":"businesses","category":"other","nicknames":[],"who_cares":["huatian","oa8000","java","tomcat","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Arbitrary server files readable, including credentials and configuration","analyst_note":"Find the affected and fixed OA8000 versions and any vendor patch; the NVD and VulnCheck pages are the sources to check.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-oa8000"],"who_is_affected":"Organizations running the Huatian Dynamic OA8000 collaborative office system exposed to the network are affected, since the flaw needs no login. The sources do not say which OA8000 versions are affected or whether the vendor has released a fix.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00071,"input_tokens":4690,"output_tokens":482,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed OA8000 versions and any vendor patch; the NVD and VulnCheck pages are the sources to check.","search":"'-11':149C '-20':150C '-2024':12A,15A '-58406':13A,16A '/oaapp/jsp/trace/ntkodownload.jsp':85C '2024':148C 'accept':52B 'access':99C 'arbitrari':59B,114C 'attack':56B,108C 'collabor':36B,75C 'compromis':137C 'configur':66B,123C,128C 'contain':78C 'credenti':71B,131C 'cve':11A,14A 'directori':103C 'dynam':34B,73C 'dynamic':18A 'enabl':135C 'evid':139C 'exploit':138C 'expos':126C 'file':10A,60B,67B,96C,115C 'filenam':50B,88C 'first':141C 'flaw':43B 'foundat':146C 'hold':70B 'host':29B 'huatian':1A,17A,20B,33B,72C 'includ':64B 'intend':102C 'java':21B 'let':5A 'locat':94C 'materi':132C 'may':69B 'ntkodownload.jsp':46B 'oa8000':2A,19A,22B,35B,74C 'observ':142C 'offic':3A,37B,76C 'page':47B 'paramet':51B,90C 'path':25B,41B,81C 'path-travers':24B 'read':8A,58B,113C 'reject':105C 'request':89C 'restrict':98C 'root/web-inf/web.xml':125C 'self':28B 'self-host':27B 'sensit':127C 'sequenc':53B,107C,111C 'server':9A,63B,118C 'shadowserv':145C 'sourc':129C 'suppli':110C 'system':4A,38B,77C 'tomcat':30B,65B,122C 'travers':26B,42B,82C,106C 'unauthent':6A,31B,55B,80C 'use':92C 'visitor':7A 'vulner':83C 'without':97C","nicknames":[],"mitigations":[],"who_affected":"Organisations running a self-hosted Huatian Dynamic OA8000 collaborative office system, especially with the web interface reachable from the internet. The flaw needs no login and exposes server files such as Tomcat web.xml, which can hold credentials. Teams that do not run OA8000 can skip it.","tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["dynamicoa8000","huatiandynamicoa8000"],"ptokens":["dynamic","huatian","oa8000"],"labels":["high","huatian","java","oa8000","other","pathtraversal","selfhosted","tomcat","unauthenticated"],"campaign_type":null,"search_a":"'-2024':12A,15A '-58406':13A,16A 'cve':11A,14A 'dynamic':18A 'file':10A 'huatian':1A,17A 'let':5A 'oa8000':2A,19A 'offic':3A 'read':8A 'server':9A 'system':4A 'unauthent':6A 'visitor':7A","search_b":"'accept':52B 'arbitrari':59B 'attack':56B 'collabor':36B 'configur':66B 'credenti':71B 'dynam':34B 'file':60B,67B 'filenam':50B 'flaw':43B 'hold':70B 'host':29B 'huatian':20B,33B 'includ':64B 'java':21B 'may':69B 'ntkodownload.jsp':46B 'oa8000':22B,35B 'offic':37B 'page':47B 'paramet':51B 'path':25B,41B 'path-travers':24B 'read':58B 'self':28B 'self-host':27B 'sequenc':53B 'server':63B 'system':38B 'tomcat':30B,65B 'travers':26B,42B 'unauthent':31B,55B","search_c":"'-11':149C '-20':150C '/oaapp/jsp/trace/ntkodownload.jsp':85C '2024':148C 'access':99C 'arbitrari':114C 'attack':108C 'collabor':75C 'compromis':137C 'configur':123C,128C 'contain':78C 'credenti':131C 'directori':103C 'dynam':73C 'enabl':135C 'evid':139C 'exploit':138C 'expos':126C 'file':96C,115C 'filenam':88C 'first':141C 'foundat':146C 'huatian':72C 'intend':102C 'locat':94C 'materi':132C 'oa8000':74C 'observ':142C 'offic':76C 'paramet':90C 'path':81C 'read':113C 'reject':105C 'request':89C 'restrict':98C 'root/web-inf/web.xml':125C 'sensit':127C 'sequenc':107C,111C 'server':118C 'shadowserv':145C 'sourc':129C 'suppli':110C 'system':77C 'tomcat':122C 'travers':82C,106C 'unauthent':80C 'use':92C 'vulner':83C 'without':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T16:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2024-58406","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-58406","severity":null,"published_at":"2026-11-13T16:17:18+00:00","modified_at":"2026-11-13T16:17:18+00:00","first_seen_at":"2026-11-13T16:47:32+00:00","fetched_at":"2026-11-13T16:47:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2024-58406:3908","url":null,"severity":null,"published_at":"2026-11-13T16:50:04+00:00","modified_at":"2026-11-13T16:50:04+00:00","first_seen_at":"2026-11-13T16:50:04+00:00","fetched_at":"2026-11-13T16:50:04+00:00","note":"Only VulnCheck advisory read (a secondary CNA record, not the vendor). No affected or fixed versions and no vendor patch found; fix unknown. VulnCheck says Shadowserver saw exploitation from 2024-11-20, so exploited=true; no PoC link read. Nothing verified."}],"documents":[{"id":147635,"url":"https://www.vulncheck.com/advisories/huatian-oa8000-path-traversal-via-ntkodownload-jsp","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}