PT-2024-31690 · Unknown · Symphony Xts Web Trading Platform

Mohit Gadiya · Published 2024-09-03 · Updated 2024-09-07 · CVE-2024-45587

Positive Technologies (AI Summary)

CVSS v4.0

9.1

Critical

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Symphony XTS Web Trading platform version 2.0.0.1 P160

Description: This issue exists due to improper access controls on APIs in the Transaction module of the vulnerable application. An authenticated remote attacker could exploit this by manipulating parameters through HTTP requests, potentially leading to the compromise of other user accounts.

Recommendations: For Symphony XTS Web Trading platform version 2.0.0.1 P160, consider restricting access to the Transaction module until a patch is available. As a temporary workaround, avoid using the vulnerable APIs in the Transaction module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-45587

Affected Products

Symphony Xts Web Trading Platform

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2024-45587 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45587 · Vendor Advisory
• https://twitter.com/cracbot/status/1832660197502075032 · Twitter Post
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0281 · Note
• https://twitter.com/CVEnew/status/1830912680887980543 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1830949869164417099 · Twitter Post
• https://t.me/cvenotify/93033 · Telegram Post
• https://t.me/cvedetector/4676 · Telegram Post
• https://t.me/cvenotify/93095 · Telegram Post
• https://t.me/latest_high_impact_cve/1096 · Telegram Post