PT-2024-32710 · Unknown · Shilpi Client Dashboard

Mohit Gadiya · Published 2024-10-04 · Updated 2024-10-10 · CVE-2024-47651

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Shilpi Client Dashboard (affected versions not specified)

Description This issue exists due to improper handling of multiple parameters in the API endpoint. An authenticated remote attacker could exploit this by including multiple userid parameters in the API request body, leading to unauthorized access of sensitive information belonging to other users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-235

Related Identifiers

CVE-2024-47651

Affected Products

Shilpi Client Dashboard

References · 10

• https://osv.dev/vulnerability/CVE-2024-47651 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47651 · Security Note
• https://twitter.com/CVEnew/status/1842180454121890170 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1842232469136846956 · Twitter Post
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0313 · Note
• https://twitter.com/oktsec/status/1842197387881730419 · Twitter Post
• https://t.me/latest_high_impact_cve/1249 · Telegram Post
• https://t.me/cvenotify/97830 · Telegram Post
• https://t.me/cvedetector/6970 · Telegram Post
• https://t.me/cvenotify/97020 · Telegram Post