PT-2024-24242 · Italtel · Italtel Embrace

Fabio Romano + 3 · Published 2024-05-21 · Updated 2024-07-03 · CVE-2024-31845

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Italtel Embrace version 1.6.4

Description An issue was discovered in the product where it does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter, which can be modified by an attacker to attribute every action they perform to a different user. This can be exploited without authentication.

Recommendations For Italtel Embrace version 1.6.4, consider restricting access to the logging functionality to prevent exploitation. As a temporary workaround, avoid using the GET query string parameter for logging until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-117

Related Identifiers

CVE-2024-31845

Affected Products

Italtel Embrace

References · 5

• 🔥 https://gruppotim.it/it/footer/red-team.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-31845 · Security Note
• https://osv.dev/vulnerability/CVE-2024-31845 · Vendor Advisory
• https://twitter.com/CVEnew/status/1793284029359513723 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1792994988013281445 · Twitter Post