PT-2024-32712 · Unknown · Shilpi Client Dashboard

Mohit Gadiya · Published 2024-10-04 · Updated 2024-10-16 · CVE-2024-47653

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Shilpi Client Dashboard (affected versions not specified)

Description This issue exists due to a lack of authorization for modification and cancellation requests through certain API endpoints. An authenticated remote attacker could exploit this by placing or cancelling requests through the API request body, leading to unauthorized modification of requests belonging to other users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2024-47653

Affected Products

Shilpi Client Dashboard

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-47653 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47653 · Vendor Advisory
• https://t.me/cvedetector/6985 · Telegram Post
• https://twitter.com/CVEnew/status/1842180450544234548 · Twitter Post
• https://t.me/latest_high_impact_cve/1251 · Telegram Post
• https://t.me/cvenotify/98299 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1842218381874770332 · Twitter Post
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0313 · Note