CVE-2024-3706 is a medium severity vulnerability (CVSS 5.9) in OpenGnsys. A php backup file, controlaccess.php-LAST, can be viewed by an attacker and contains database credentials. The record points to a security patch notice on the OpenGnsys site and an INCIBE-CERT advisory.
What's affected
- OpenGnsys version 1.1.1d (Espeto), according to the record.
Severity in the record: Medium, CVSS 5.9, vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. In plain terms: over the network, no privileges required, no user interaction. Weakness class: CWE-200, exposure of sensitive information.
Fixed version: The record points to a security patch notice on the OpenGnsys site and an INCIBE-CERT advisory. Neither was retrievable when this post was written, so confirm the patched build there.
The record's KEV flag is false, so this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and no source reviewed here reports exploitation in the wild.
How to check if you're exposed
- Look for the file on your server:
find / -name 'controlaccess.php-LAST' 2>/dev/null. - If you find it, test whether your web server serves it by requesting its URL from a machine outside your network, and compare with the vendor patch notice.
What to do now
- Apply the vendor security patch.
- Delete backup and temporary copies of source files from the web root.
- Rotate any credentials that were stored in an exposed file.
- Record the decision in your tracker with the CVE id and the date, so the next audit can see what you did about CVE-2024-3706.
Why it matters
Sensitive data can leak through a file nobody meant to publish, such as an editor backup, a log, or a configuration copy. If the web server serves it as plain text or lets it be downloaded, the contents are open to anyone who knows or guesses the name. Deploy pipelines should exclude backups, and secrets should live outside the web root.
Backup copies of source files are a classic leak. A web server that runs controlaccess.php will execute it, but one that serves controlaccess.php-LAST sends it as text, credentials included. The lesson applies well beyond this product: keep backup and editor copies out of any directory the web server publishes.
Look up the entry on Gold to see how it connects to other advisories, and use reachability analysis to separate the components that actually call vulnerable code from the ones that merely sit in your inventory.
Quick check
If I delete the backup file, am I done?
Deleting it closes the exposure, but the credentials may already have been read. Rotate the database credentials and apply the vendor patch.
Is CVE-2024-3706 in the CISA KEV catalog?
No. The record's KEV flag is false.
Sources
These links come from the NVD record. They were not retrievable when this post was written, so the details above rest on the record text. Check them before you act.
Last reviewed: 19 October 2026.
