by Kastro
Paper/Archive/CVE-2024-45588

CVE-2024-45588

Symphony Fintech XTS Web Trader — Information Disclosure Vulnerability

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
33
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 30.2.302 × 206.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Preference module of the application. An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized access and modification of sensitive information belonging to other users.

Affected

ProductAffectedFixed inSource
XTS Web Trader2.0.0.1_P160–CNA
xts_web_trader2.0.0.1_p160–CISA-ADP

Scores by source

CERT-In (CNA)9.1CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

writeupcert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0281