CVE-2024-45587 | THREATINT

Description

This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Transaction module of vulnerable application. An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to compromise of other user accounts.

PUBLISHED Reserved 2024-09-02 | Published 2024-09-03 | Updated 2024-09-04 | Assigner CERT-In

CRITICAL: 9.1CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-863: Incorrect Authorization

Product status

Default status

unaffected

2.0.0.1_P160

affected

Credits

This vulnerability is reported by Mohit Gadiya finder

References

www.cert-in.org.in/...eid=PUBVLNOTES01&VLCODE=CIVN-2024-0281 third-party-advisory

cve.org (CVE-2024-45587)

nvd.nist.gov (CVE-2024-45587)

Download JSON