PT-2024-15060 · Unknown · Hearing Tracking System

Published 2024-02-09 · Updated 2024-02-15 · CVE-2023-6724

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hearing Tracking System versions prior to IOS 7.0 Hearing Tracking System for Android version 1.0

Description The issue allows authentication abuse through an authorization bypass using a user-controlled key. This affects the Hearing Tracking System, enabling potential authentication abuse.

Recommendations For Hearing Tracking System versions prior to IOS 7.0, update to a version that includes the necessary security patches. For Hearing Tracking System for Android version 1.0, consider disabling authentication mechanisms that rely on user-controlled keys until a patch is available.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-6724

Affected Products

Hearing Tracking System

References · 8

• https://osv.dev/vulnerability/CVE-2023-6724 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6724 · Security Note
• https://usom.gov.tr/bildirim/tr-24-0099 · Note
• https://twitter.com/VulmonFeeds/status/1755981204896026837 · Twitter Post
• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-0099 · Note
• https://twitter.com/CVEnew/status/1755936335901188402 · Twitter Post
• https://t.me/cvenotify/70796 · Telegram Post
• https://twitter.com/EASM_HydrAttack/status/1756166272193090026 · Twitter Post