PT-2024-22548 · Unit4 · Unit4 Financials

Published 2024-03-20 · Updated 2025-06-17 · CVE-2024-28735

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Unit4 Financials by Coda versions prior to 2023Q4

Description The issue is related to an incorrect access control authorization bypass, allowing an authenticated user to modify the password of any user of the application via a crafted request.

Recommendations For versions prior to 2023Q4, update to version 2023Q4 or later to resolve the issue.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2024-28735

Affected Products

Unit4 Financials

References · 9

• 🔥 https://packetstormsecurity.com/files/177620/Financials-By-Coda-Authorization-Bypass.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-28735 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28735 · Vendor Advisory
• https://t.me/cvenotify/125912 · Telegram Post
• http://financials.com · Note
• https://unit4.com · Note
• http://unit4.com · Note
• https://t.me/cvenotify/75385 · Telegram Post
• https://unit4.com/products/financial-management-software · Note