PT-2024-32716 · Unknown · Shilpi Net Back Office

Mohit Gadiya · Published 2024-10-04 · Updated 2024-10-16 · CVE-2024-47657

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Shilpi Net Back Office (affected versions not specified)

Description This issue exists due to improper access controls on certain API endpoints. An authenticated remote attacker could exploit this by manipulating the dfclientid parameter through API request URLs, leading to unauthorized access to sensitive information belonging to other users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-47657

Affected Products

Shilpi Net Back Office

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-47657 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47657 · Vendor Advisory
• https://twitter.com/oktsec/status/1842227629220413847 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1842223504449524195 · Twitter Post
• https://t.me/cvenotify/98307 · Telegram Post
• https://t.me/cvedetector/6974 · Telegram Post
• https://t.me/latest_high_impact_cve/1250 · Telegram Post
• https://twitter.com/CVEnew/status/1842188366906839223 · Twitter Post
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0313 · Note