PT-2024-27813 · Unknown · Myfinances

Matthewlaitinen · Published 2024-06-14 · Updated 2024-08-08 · CVE-2024-37889

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MyFinances versions prior to 0.4.6

Description The issue allows an actor to access personally identifiable information (PII) and financial information from another account while signed in as a user. This is due to a method in the application that enables access to other customer invoices.

Recommendations For versions prior to 0.4.6, update to version 0.4.6 to resolve the issue.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-37889

GHSA-4884-3GVP-3WJ2

Affected Products

Myfinances

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37889.json · Exploit
• 🔥 https://github.com/TreyWW/MyFinances/security/advisories/GHSA-4884-3gvp-3wj2 · Exploit
• https://github.com/TreyWW/MyFinances/commit/2c1e6d5b7ec8b2d6f660b260e3c5f4d3eaaa613f · Patch
• https://osv.dev/vulnerability/CVE-2024-37889 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37889 · Security Note
• https://t.me/cvenotify/83373 · Telegram Post