PT-2024-35357 · Unknown · Budget Control Gateway

Published 2024-11-15 · Updated 2024-11-18 · CVE-2024-52528

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Budget Control Gateway versions prior to 1.5.2

Description The Budget Control Gateway acts as an entry point for incoming requests and routes them to the appropriate microservices for Budget Control. It does not properly validate auth tokens, which allows attackers to bypass intended restrictions.

Recommendations For versions prior to 1.5.2, update to version 1.5.2 to fix the vulnerability. As a temporary workaround, consider restricting access to the Budget Control Gateway until the update is applied.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2024-52528

GHSA-JQX6-GM7F-VP7M

Affected Products

Budget Control Gateway

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52528.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-52528 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52528 · Security Note
• https://t.me/cvedetector/11110 · Telegram Post
• https://twitter.com/CVEnew/status/1857476946520662484 · Twitter Post
• https://github.com/BudgetControl/Gateway/security/advisories/GHSA-jqx6-gm7f-vp7m · Note
• https://twitter.com/CveFindCom/status/1857461713651507455 · Twitter Post