PT-2024-34702 · Wave · Wave

Mohit Gadiya · CVE-2024-51559 · Published 2024-11-04 · Updated 2024-11-22

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Wave version 2.0

Description This issue is caused by improper or missing authorization checks on certain API endpoints. An authenticated remote attacker could exploit this by manipulating API input parameters to gain unauthorized access and perform malicious activities on other user accounts.

Recommendations For Wave version 2.0, consider restricting access to vulnerable API endpoints until a patch is available. As a temporary workaround, limit the manipulation of API input parameters to prevent unauthorized access.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-51559

Affected Products

Wave

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-51559 · Security Note
• https://osv.dev/vulnerability/CVE-2024-51559 · Vendor Advisory
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332 · Note
• https://t.me/latest_high_impact_cve/1450 · Telegram Post
• https://twitter.com/CVEnew/status/1853414864221282373 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1853533281544782306 · Twitter Post
• https://t.me/cvedetector/9728 · Telegram Post