PT-2024-31769 · Reedos · Reedos Aim-Star

Mohit Gadiya · Published 2024-09-11 · Updated 2024-09-18 · CVE-2024-45789

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Reedos aiM-Star version 2.0.1

Description: This issue exists due to improper validation of the mode parameter in the API endpoint used during the registration process. An authenticated remote attacker could exploit this by manipulating the parameter in the API request body, potentially bypassing certain constraints in the registration process and allowing the creation of multiple accounts.

Recommendations: For Reedos aiM-Star version 2.0.1, consider restricting access to the API endpoint used in the registration process until a patch is available, and avoid manipulating the mode parameter in the API request body to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-354

Related Identifiers

CVE-2024-45789

Affected Products

Reedos Aim-Star

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-45789 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45789 · Vendor Advisory
• https://t.me/cvenotify/94146 · Telegram Post
• https://twitter.com/CVEnew/status/1833845373561086326 · Twitter Post
• https://t.me/cvenotify/95151 · Telegram Post
• https://t.me/cvedetector/5347 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1833881470265368842 · Twitter Post
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0291 · Note