PT-2024-35164 · Envaysoft · Envaysoft Fleetcart

Skalvin · Published 2024-05-22 · Updated 2024-06-04 · CVE-2024-5230

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions EnvaySoft FleetCart versions up to 4.1.1

Description A vulnerability has been found in EnvaySoft FleetCart, allowing for information disclosure through the manipulation of the razorpayKeyId argument. The attack can be launched remotely, affecting an unknown functionality. It is recommended to upgrade the affected component to secure data.

Recommendations For EnvaySoft FleetCart versions up to 4.1.1, it is recommended to upgrade the affected component to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting the use of the razorpayKeyId argument to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-5230

Affected Products

Envaysoft Fleetcart

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-5230 · Security Note
• https://t.me/cvenotify/80809 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1793516725612261815 · Twitter Post
• https://vuldb.com/?id.265981 · Note
• https://vuldb.com/?submit.333519 · Note
• https://vuldb.com/?ctiid.265981 · Note
• https://twitter.com/CVEnew/status/1793468862333108247 · Twitter Post
• https://twitter.com/linuxpatch/status/1793479640708739218 · Twitter Post