Back

CVE-2024-45586

Sept. 3, 2024, 7:55 p.m.

Analyzed
CVE has been recently published to the CVE List and has been received by the NVD.

Products

Symphony XTS Web Trading and Mobile Trading platforms

  • 2.0.0.1_P160

xts_mobile_trader

  • 2
  • .
  • 0
  • .
  • 0
  • .
  • 1

xts_web_trader

  • 2
  • .
  • 0
  • .
  • 0
  • .
  • 1

Source

vdisclose@cert-in.org.in

Tags

CWE-863
vdisclose@cert-in.org.in
NVD-CWE-Other
2024-09-03
CVE-2024-45586

CVE-2024-45586 details

Published : Sept. 3, 2024, 10:15 a.m.
Last Modified : Sept. 3, 2024, 7:55 p.m.

Description

This vulnerability exists due to improper access controls on APIs in the Authentication module of Symphony XTS Web Trading and Mobile Trading platforms (version 2.0.0.1_P160). An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized account take over belonging to other users.

CVSS Score

1 2 3 4 5 6 7 8.8 9 10

Weakness

Weakness Name Description
CWE-863 Incorrect Authorization The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

8.8

Exploitability Score

2.8

Impact Score

5.9

Base Severity

HIGH

Vector String : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

URL Source
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0281 vdisclose@cert-in.org.in

CPEs

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a symphonyfintech xts_mobile_trader 2.0.0.1 p160 / / / / / /
a symphonyfintech xts_web_trader 2.0.0.1 p160 / / / / / /
This website uses the NVD API, but is not approved or certified by it.