PT-2024-31588 · Unknown · Janto Ticketing

Alejandro Amorín Niño · Published 2024-05-07 · Updated 2024-05-07 · CVE-2024-4538

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Janto Ticketing Software version 4.3r10

Description The issue allows a remote user to obtain a user's event ticket by creating a specific request with the ticket reference ID, leading to the exposure of sensitive user data. This is due to an Insecure Direct Object Reference (IDOR) vulnerability.

Recommendations For version 4.3r10, consider restricting access to the ticket reference ID to prevent unauthorized access to event tickets until a patch is available. As a temporary workaround, avoid using the ticket reference ID in requests to minimize the risk of exploitation.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-4538

Affected Products

Janto Ticketing

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-4538 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-janto-ticketing-software · Note
• https://t.me/cvenotify/79384 · Telegram Post
• https://twitter.com/CVEnew/status/1787888354136043691 · Twitter Post