PT-2024-29436 · Feripro · Feripro

Pius Walter · Published 2024-08-02 · Updated 2024-09-03 · CVE-2024-41518

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Feripro versions prior to 2.2.3

Description The issue concerns an Incorrect Access Control vulnerability. It affects the "/admin/programm//export/statistics" endpoint, allowing remote attackers to export an XLSX file containing information about registrations and participants.

Recommendations For versions prior to 2.2.3, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the "/admin/programm//export/statistics" endpoint to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-41518

Affected Products

Feripro

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-41518 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41518 · Vendor Advisory
• https://t.me/cvedetector/2360 · Telegram Post
• https://piuswalter.de/blog/multiple-vulnerabilities-in-feripro · Note
• http://mecodia.de · Note
• http://feripro.de · Note