by Kastro
Paper/Archive/CVE-2024-45586

CVE-2024-45586

Symphony Fintech XTS Web Trader — Account Take Over Vulnerability

EPSS 0.4%CVSS 9.2
critical.is priorityof 100
35
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 37.6.376 × 207.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

This vulnerability exists due to improper access controls on APIs in the Authentication module of Symphony XTS Web Trading and Mobile Trading platforms (version 2.0.0.1_P160). An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized account take over belonging to other users.

Affected

ProductAffectedFixed inSource
XTS Web Trader2.0.0.1_P160–CNA
XTS Mobile Trader2.0.0.1_P160–CNA
xts_web_trader2.0.0.1_p160–CISA-ADP
xts_mobile_trader2.0.0.1_p160–CISA-ADP

Scores by source

CERT-In (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

writeupcert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0281