PT-2024-29435 · Feripro · Feripro

Pius Walter · Published 2024-08-02 · Updated 2024-10-28 · CVE-2024-41517

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Feripro versions prior to 2.2.3

Description The issue is related to an Incorrect Access Control vulnerability. It affects the "/admin/benutzer/institution/rechteverwaltung/uebersicht" endpoint, allowing remote attackers to obtain a list of all users and their corresponding privileges.

Recommendations For Feripro versions prior to 2.2.3, consider restricting access to the "/admin/benutzer/institution/rechteverwaltung/uebersicht" endpoint until a fix is available.

Fix

Related Identifiers

CVE-2024-41517

Affected Products

Feripro

References · 6

• https://osv.dev/vulnerability/CVE-2024-41517 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41517 · Security Note
• https://t.me/cvedetector/2359 · Telegram Post
• https://piuswalter.de/blog/multiple-vulnerabilities-in-feripro · Note
• http://mecodia.de · Note
• http://feripro.de · Note