PT-2024-26993 · Targit · Targit Decision Suite

Published 2024-05-27 · Updated 2025-03-18 · CVE-2024-36426

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TARGIT Decision Suite versions 23.2.15007.0 and earlier

Description The session token is part of the URL and may be sent in a cleartext HTTP session, which could potentially expose sensitive information.

Recommendations For TARGIT Decision Suite versions 23.2.15007.0 and earlier, consider updating to a version released after Autumn 2023 to ensure the session token is properly secured. As a temporary workaround, restrict the use of HTTP sessions to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-279

CWE-319

Related Identifiers

CVE-2024-36426

Affected Products

Targit Decision Suite

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-36426 · Security Note
• https://community.targit.com/hc/en-us/articles/16112758176156-Vulnerabilities · Note
• https://t.me/cvenotify/96349 · Telegram Post
• https://t.me/cvenotify/115216 · Telegram Post
• https://github.com/DMCERTCE/DecisionSuite_Token_in_Url · Note
• https://community.targit.com/hc/en-us/articles/12618082416028-Change-Log-On-prem · Note
• https://t.me/cvenotify/81102 · Telegram Post