Back

CVE-2024-45587

Sept. 3, 2024, 7:55 p.m.

Analyzed
CVE has been recently published to the CVE List and has been received by the NVD.

Products

Symphony XTS Web Trading platform

  • 2.0.0.1_P160

xts_mobile_trader

  • 2
  • .
  • 0
  • .
  • 0
  • .
  • 1

xts_web_trader

  • 2
  • .
  • 0
  • .
  • 0
  • .
  • 1

Source

vdisclose@cert-in.org.in

Tags

CWE-863
vdisclose@cert-in.org.in
NVD-CWE-Other
2024-09-03
CVE-2024-45587

CVE-2024-45587 details

Published : Sept. 3, 2024, 10:15 a.m.
Last Modified : Sept. 3, 2024, 7:55 p.m.

Description

This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Transaction module of vulnerable application. An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to compromise of other user accounts.

CVSS Score

1 2 3 4 5 6 7 8.8 9 10

Weakness

Weakness Name Description
CWE-863 Incorrect Authorization The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

8.8

Exploitability Score

2.8

Impact Score

5.9

Base Severity

HIGH

Vector String : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

URL Source
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0281 vdisclose@cert-in.org.in

CPEs

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a symphonyfintech xts_mobile_trader 2.0.0.1 p160 / / / / / /
a symphonyfintech xts_web_trader 2.0.0.1 p160 / / / / / /
This website uses the NVD API, but is not approved or certified by it.