PT-2024-24139 · Unknown · Reportico Web

Aashiqahamedno · Published 2024-05-14 · Updated 2024-07-03 · CVE-2024-31556

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Reportico Web versions prior to 8.1.0

Description The issue allows a local attacker to execute arbitrary code and obtain sensitive information via the sessionid function. This vulnerability arises from the failure of the web application to properly invalidate session cookies upon logout, allowing an attacker to exploit the active session cookie and perform unauthorized actions.

Recommendations For versions prior to 8.1.0, update to version 8.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the sessionid function until a patch is available. Additionally, ensure that session cookies are properly invalidated upon logout to minimize the risk of exploitation.

Fix

Improper Privilege Management

Insufficient Session Expiration

Weakness Enumeration

CWE-269

CWE-613

Related Identifiers

CVE-2024-31556

GHSA-2Q2F-H83X-CX3X

Affected Products

Reportico Web

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-31556 · Security Note
• https://osv.dev/vulnerability/GHSA-2q2f-h83x-cx3x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-31556 · Vendor Advisory
• https://github.com/reportico-web/reportico/issues/53 · Note
• https://github.com/reportico-web/reportico · Note
• https://t.me/cvenotify/79869 · Telegram Post