Today > vulnerabilities   -   You can now download lists of IOCs here!

CVE-2024-45789

Sept. 18, 2024, 7:55 p.m.

CVSS Score

4.3 / 10

Products Impacted

Vendor Product Versions
reedos
  • aim-star
  • 2.0.1

Description

This vulnerability exists in Reedos aiM-Star version 2.0.1 due to improper validation of the ‘mode’ parameter in the API endpoint used during the registration process. An authenticated remote attacker could exploit this vulnerability by manipulating parameter in the API request body on the vulnerable application. Successful exploitation of this vulnerability could allow the attacker to bypass certain constraints in the registration process leading to creation of multiple accounts.

Weaknesses

CWE-354
Improper Validation of Integrity Check Value

The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

CWE ID: 354

Date

Published: Sept. 11, 2024, 12:15 p.m.

Last Modified: Sept. 18, 2024, 7:55 p.m.

Status : Analyzed

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

vdisclose@cert-in.org.in

CPEs

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a reedos aim-star 2.0.1 / / / / / / /

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

Base Score
4.3
Exploitability Score
2.8
Impact Score
1.4
Base Severity
MEDIUM
CVSS Vector String

The CVSS vector string provides an in-depth view of the vulnerability metrics.

View Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://www.cert-in.org.in/ vdisclose@cert-in.org.in