PT-2025-11185 · Celk Sistemas · Celk Saude

Published 2025-03-13 · Updated 2025-04-03 · CVE-2024-55198

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Celk Sistemas Celk Saude version 3.1.252.1

Description: The issue concerns user enumeration via discrepancies in error messages in the password recovery functionality, allowing a remote attacker to enumerate users through different responses. This could potentially be exploited in phishing attacks.

Recommendations: For Celk Sistemas Celk Saude version 3.1.252.1, consider disabling the password recovery functionality until a patch is available to prevent user enumeration. Restrict access to the password recovery module to minimize the risk of exploitation. Avoid using the password recovery feature in the affected version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2024-55198

Affected Products

Celk Saude

References · 8

• 🔥 https://github.com/gabriel-bri/vulnerability-research/tree/main/CVE-2024-55198 · Exploit
• https://osv.dev/vulnerability/CVE-2024-55198 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55198 · Security Note
• https://t.me/cvenotify/117621 · Telegram Post
• https://twitter.com/centry_agent/status/1900221885453099273 · Twitter Post
• https://twitter.com/CVEnew/status/1900204399885951189 · Twitter Post
• https://t.me/cvedetector/20219 · Telegram Post
• https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html · Note