SecuriTricks - CVE-2024-12667

Description

A vulnerability was found in InvoicePlane up to 1.6.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /invoices/view. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.6.2-beta-1 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Product(s) Impacted

Vendor	Product	Versions
Invoiceplane	Invoiceplane	*

Weaknesses

CWE-613

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

*CPE(s)

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	invoiceplane	invoiceplane	/	/	/	/	/	/	/	/

References

https://github.com/InvoicePlane/InvoicePlane/releases/tag/v1.6.2-beta-1

https://vuldb.com/?ctiid.288536

https://vuldb.com/?id.288536

https://vuldb.com/?submit.449923

CVSS Score

3.7 / 10

CVSS Data

Attack Vector: NETWORK
Attack Complexity: HIGH
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: LOW
Integrity Impact: NONE
Availability Impact: NONE

View Vector String

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Date

Published: Dec. 16, 2024, 8:15 p.m.
Last Modified: Dec. 19, 2024, 3:10 p.m.

Status : Analyzed

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cna@vuldb.com

CVE-2024-12667