CVE-2024-31845

An issue was discovered in Italtel Embrace 1.6.4

Medium · published May 21, 2024

CVSS v3.1
5.3
EPSS
0%
Percentile
37.3
In the wild
Unconfirmed
What it is

An issue was discovered in Italtel Embrace 1.6.4. The product does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter. This parameter can be modified by an attacker, so that every action he performs is attributed to a different user. This can be exploited without authentication.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00441 · 37.3th percentile
Published
2024-05-21T15:33Z
EPSS history
Timeline
  • 21 MAY 15:33Z
    An issue was discovered in Italtel Embrace 1.6.4
    cvelistv5