PT-2024-39671 · Netadmin · Netadmin Iam

Tristao · Published 2024-10-04 · Updated 2024-11-14 · CVE-2024-9513

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Netadmin Software NetAdmin IAM versions up to 3.5

Description A vulnerability was found in the HTTP POST Request Handler component, specifically affecting the /controller/api/Answer/ReturnUserQuestionsFilled file. The manipulation of the username argument leads to information exposure through discrepancy. This issue can be exploited remotely, with a rather high complexity of attack and difficult exploitation. The exploit has been disclosed to the public.

Recommendations For Netadmin Software NetAdmin IAM versions up to 3.5, the vendor is planning to release a fix in mid-October 2024. As a temporary workaround, consider restricting access to the /controller/api/Answer/ReturnUserQuestionsFilled API endpoint or disabling the manipulation of the username argument until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2024-9513

Affected Products

Netadmin Iam

References · 11

• 🔥 https://vuldb.com/?submit.413498 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-9513 · Security Note
• https://osv.dev/vulnerability/CVE-2024-9513 · Vendor Advisory
• https://t.me/cvedetector/6972 · Telegram Post
• https://t.me/cvenotify/97363 · Telegram Post
• https://t.me/cvenotify/101617 · Telegram Post
• https://vuldb.com/?id.279212 · Note
• https://twitter.com/CVEnew/status/1842188365736599588 · Twitter Post
• https://twitter.com/UndercodeNews/status/1856887773518516632 · Twitter Post
• https://vuldb.com/?ctiid.279212 · Note
• https://twitter.com/VulmonFeeds/status/1842231188322144291 · Twitter Post