by Kastro
Paper/Archive/CVE-2024-45587

CVE-2024-45587

Symphony Fintech XTS Web Trader — Unauthorized Modification Vulnerability

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
35
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 36.0.360 × 207.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Transaction module of vulnerable application. An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to compromise of other user accounts.

Affected

ProductAffectedFixed inSource
XTS Web Trader2.0.0.1_P160–CNA
xts_web_trader2.0.0.1_p160–CISA-ADP

Scores by source

CERT-In (CNA)9.1CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

writeupcert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0281