CVE-2024-12123CWE-472CWE-837

Unauthorized Modification of Ticket Requester

Medium · published December 4, 2024

CVSS v4.0
5.3
EPSS
0%
Percentile
30.5
In the wild
Unconfirmed
What it is

A hidden field manipulation vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user.

When an authenticated user submits a ticket, the request can be intercepted and subsequently modified by using a proxy.  The ticket requester can be changed from the original requester to another user in the same application,

which the application then accepts.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00376 · 30.5th percentile
Weaknesses
CWE-472 · External Control of Assumed-Immutable Web Parameter; CWE-837 · Improper Enforcement of a Single, Unique Action
Published
2024-12-04T03:26Z
EPSS history
Timeline
  • 04 DEC 03:26Z
    Unauthorized Modification of Ticket Requester
    cvelistv5