PT-2024-39123 · Techexcel · Techexcel Back Office

Mohit Gadiya · Published 2024-09-09 · Updated 2024-09-17 · CVE-2024-8601

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: TechExcel Back Office Software versions prior to 1.0.0

Description: This issue exists due to improper access controls on certain API endpoints, allowing an authenticated remote attacker to exploit the vulnerability by manipulating a parameter through the API request URL. This could lead to unauthorized access to sensitive information belonging to other users.

Recommendations: For versions prior to 1.0.0, update to version 1.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive API endpoints until a patch is available. Avoid using manipulated parameters in API requests to minimize the risk of exploitation.

Fix

Incorrect Authorization

IDOR

Weakness Enumeration

CWE-863

CWE-639

Related Identifiers

CVE-2024-8601

Affected Products

Techexcel Back Office

References · 10

• https://osv.dev/vulnerability/CVE-2024-8601 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8601 · Security Note
• https://t.me/cvenotify/93754 · Telegram Post
• https://t.me/latest_high_impact_cve/1119 · Telegram Post
• https://t.me/cvedetector/5102 · Telegram Post
• https://t.me/cvenotify/94968 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1833123745751326925 · Twitter Post
• https://twitter.com/CveFindCom/status/1833075723638034618 · Twitter Post
• https://twitter.com/CVEnew/status/1833077728171692156 · Twitter Post
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0285 · Note