PT-2024-17449 · Issuetrak · Issuetrak

Harrison Daley · Published 2024-12-04 · Updated 2024-12-04 · CVE-2024-12123

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Issuetrak version 17.1

Description A hidden field manipulation issue was identified that could be triggered by an authenticated user. When an authenticated user submits a ticket, the request can be intercepted and modified by using a proxy. The ticket requester can be changed from the original requester to another user in the same application, which the application then accepts.

Recommendations For Issuetrak version 17.1, consider disabling the ticket submission feature until a patch is available to prevent exploitation of the hidden field manipulation issue. Restrict access to the proxy modification functionality to minimize the risk of interception and modification of ticket requests. Avoid using the ticket submission feature with untrusted or unverified users until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-837

CWE-472

Related Identifiers

CVE-2024-12123

Affected Products

Issuetrak

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-12123 · Security Note
• https://twitter.com/CVEnew/status/1864162198282534939 · Twitter Post
• https://helpcenter.issuetrak.com/home/2340-issuetrak-release-notes · Note
• https://t.me/cvedetector/11948 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1864192001484157257 · Twitter Post