PT-2024-33297 · Netadmin · Netadmin

Brotherofjhonny · Published 2024-10-29 · Updated 2025-01-09 · CVE-2024-48955

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions NetAdmin version 4.0.30319

Description The issue concerns broken access control, allowing an attacker to exploit the lack of session authorization validation and encryption in the return of a specific endpoint call. This enables an attacker to copy the content of a browser from a user with greater privileges, thereby gaining access to the functionalities of that user. Additionally, an attacker can steal a valid session cookie and inject it into another device, granting unauthorized access through a technique known as session hijacking.

Recommendations For NetAdmin version 4.0.30319, as a temporary workaround, consider implementing additional session validation and encryption measures to prevent unauthorized access. Restrict access to sensitive functionalities and endpoints to minimize the risk of exploitation. Avoid using the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Session Fixation

Weakness Enumeration

CWE-284

CWE-384

Related Identifiers

CVE-2024-48955

Affected Products

Netadmin

References · 6

• 🔥 https://github.com/BrotherOfJhonny/CVE-2024-48955_Overview · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-48955 · Security Note
• https://netadmin.software/gestao-de-identidade-e-acesso · Note
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-48955&sortby=bydate · Note
• https://t.me/cvenotify/99934 · Telegram Post
• https://t.me/cvedetector/9353 · Telegram Post