PT-2024-31865 · Unknown · Lines Police Cad

Sourajeet Majumder · Published 2024-09-26 · Updated 2024-10-01 · CVE-2024-45979

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lines Police CAD version 1.0

Description A host header injection issue allows attackers to obtain the password reset token via user interaction with a crafted password reset link, enabling them to arbitrarily reset other users' passwords and compromise their accounts.

Recommendations For Lines Police CAD version 1.0, consider disabling the password reset functionality until a patch is available to prevent exploitation of the host header injection issue. Restrict access to the password reset link to minimize the risk of attackers obtaining the password reset token. Avoid using crafted password reset links to prevent user interaction that could lead to account compromise.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-45979

Affected Products

Lines Police Cad

References · 7

• 🔥 https://github.com/soursec/CVEs/tree/main/CVE-2024-45979 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-45979 · Security Note
• https://twitter.com/cracbot/status/1840995135896895681 · Twitter Post
• https://twitter.com/CVEnew/status/1839348148155605006 · Twitter Post
• https://t.me/cvedetector/6434 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1839389090287861939 · Twitter Post
• https://t.me/cvenotify/96186 · Telegram Post