PT-2024-34699 · Wave · Wave

Mohit Gadiya · CVE-2024-51556 · Published 2024-11-04 · Updated 2024-11-22

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Wave version 2.0

Description The issue arises from insufficient encryption of sensitive data received at the API response, allowing an authenticated remote attacker to exploit it by manipulating API input parameters. This could lead to unauthorized access to sensitive information belonging to other users.

Recommendations For Wave version 2.0, consider disabling access to sensitive API endpoints until a patch is available, and restrict manipulation of API input parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2024-51556

Affected Products

Wave

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-51556 · Security Note
• https://osv.dev/vulnerability/CVE-2024-51556 · Vendor Advisory
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332 · Note
• https://t.me/cvedetector/9731 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1853523041990389801 · Twitter Post
• https://t.me/latest_high_impact_cve/1449 · Telegram Post
• https://twitter.com/CVEnew/status/1853414867673272510 · Twitter Post