PT-2024-31846 · Solvait · Solvait

Abdulwahab Alismaeel · Published 2024-10-07 · Updated 2025-07-03 · CVE-2024-45919

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Solvait version 24.4.2

Description A security flaw has been discovered that allows an attacker to elevate their privileges. By manipulating the Request ID and Action Type parameters in "/AssignToMe/SetAction" API endpoint, an attacker can bypass approval workflows leading to unauthorized access to sensitive information or approval of fraudulent requests.

Recommendations For Solvait version 24.4.2, consider disabling the "/AssignToMe/SetAction" API endpoint or restricting access to it until a patch is available. Additionally, avoid using the Request ID and Action Type parameters in the affected endpoint to minimize the risk of exploitation.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2024-45919

Affected Products

Solvait

References · 8

• 🔥 https://gist.github.com/ipxsec/28afaf965389283a68433c7afd54d17a · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-45919 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45919 · Vendor Advisory
• https://twitter.com/CVEnew/status/1843399822897741964 · Twitter Post
• https://t.me/cvedetector/7274 · Telegram Post
• https://t.me/cvenotify/127579 · Telegram Post
• https://t.me/cvenotify/97427 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1843420421883850779 · Twitter Post