PT-2025-9830 · Unknown · Pik Online

Mucahit Ic · Published 2025-03-05 · Updated 2025-08-19 · CVE-2024-11216

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Pik Online versions through 05.03.2025

Description The issue allows for Authorization Bypass Through User-Controlled Key and Exposure of Private Personal Information to an unauthorized actor. This can lead to Account Footprinting and Session Hijacking. The vendor was contacted about this disclosure but did not respond.

Recommendations For versions through 05.03.2025, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-359

CWE-639

Related Identifiers

CVE-2024-11216

Affected Products

Pik Online

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-11216 · Security Note
• https://twitter.com/CVEnew/status/1897506922175086636 · Twitter Post
• https://t.me/cveNotify/132800 · Telegram Post
• https://usom.gov.tr/bildirim/tr-25-0052 · Note
• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0052 · Note
• https://t.me/cvenotify/113554 · Telegram Post
• https://t.me/cvedetector/19636 · Telegram Post