PT-2024-34704 · Wave 2.0 · Wave 2.0

Published 2024-11-04 · Updated 2024-11-08 · CVE-2024-51560

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Wave 2.0

Description This issue is caused by improper exception handling for invalid inputs at a certain API endpoint. An authenticated remote attacker could exploit this by providing invalid inputs for the userId parameter in the API request, leading to the generation of an error message containing sensitive information on the targeted system.

Recommendations For Wave 2.0, consider disabling the API endpoint that handles the userId parameter until a proper fix is implemented to handle exceptions for invalid inputs. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using the userId parameter in the affected API endpoint until the issue is resolved.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2024-51560

Affected Products

Wave 2.0

References · 7

• https://osv.dev/vulnerability/CVE-2024-51560 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-51560 · Security Note
• https://twitter.com/CVEnew/status/1853422944413786123 · Twitter Post
• https://t.me/cvedetector/9729 · Telegram Post
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332 · Note
• https://t.me/latest_high_impact_cve/1450 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1853520482118558026 · Twitter Post