PT-2024-32085 · Inroad · Inroad

Published 2024-09-30 · Updated 2024-11-14 · CVE-2024-46635

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions INROAD versions prior to v202402060

Description The issue concerns the API endpoint "/AccountMaster/GetCurrentUserInfo" where attackers can access sensitive information by sending a crafted payload to the UserNameOrPhoneNumber parameter. This allows unauthorized access to sensitive data.

Recommendations For versions prior to v202402060, as a temporary workaround, consider restricting access to the "/AccountMaster/GetCurrentUserInfo" API endpoint until a patch is available. Avoid using the UserNameOrPhoneNumber parameter in this endpoint to minimize the risk of exploitation. Update to version v202402060 or later to resolve the issue.

Fix

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

CVE-2024-46635

Affected Products

Inroad

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-46635 · Security Note
• https://twitter.com/CVEnew/status/1840811700284510395 · Twitter Post
• https://t.me/cvedetector/6674 · Telegram Post
• https://hithub.notion.site/Sensitive-Information-Disclosure-in-GongZhiDao-System-aaad25d2430f4a638d462194cfa87c8b · Note
• https://twitter.com/VulmonFeeds/status/1840858429818032233 · Twitter Post