PT-2024-31689 · Unknown · Symphony Xts Web Trading+1

Mohit Gadiya · Published 2024-09-03 · Updated 2024-09-07 · CVE-2024-45586

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Symphony XTS Web Trading and Mobile Trading platforms version 2.0.0.1 P160

Description: This issue exists due to improper access controls on APIs in the Authentication module. An authenticated remote attacker could exploit this by manipulating parameters through HTTP requests, potentially leading to unauthorized account takeovers belonging to other users.

Recommendations: For version 2.0.0.1 P160, consider disabling the Authentication module until a patch is available to prevent exploitation. Restrict access to the vulnerable API endpoints to minimize the risk of unauthorized account takeovers. Avoid using manipulated parameters in HTTP requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-45586

Affected Products

Symphony Xts Mobile Trading

Symphony Xts Web Trading

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-45586 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45586 · Vendor Advisory
• https://t.me/cvenotify/93032 · Telegram Post
• https://twitter.com/cracbot/status/1832660195908186623 · Twitter Post
• https://t.me/cvenotify/93094 · Telegram Post
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0281 · Note
• https://t.me/cvedetector/4674 · Telegram Post
• https://t.me/latest_high_impact_cve/1096 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1830949112721678583 · Twitter Post
• https://twitter.com/CVEnew/status/1830912682125369476 · Twitter Post