CVE-2024-45587CWE-863

Unauthorized Modification Vulnerability

Critical · published September 3, 2024

CVSS v4.0
9.1
EPSS
0%
Percentile
34.9
In the wild
Unconfirmed
What it is

This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Transaction module of vulnerable application. An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to compromise of other user accounts.

The record
Technical detail
CVSS v4.0
9.1 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00417 · 34.9th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2024-09-03T10:09Z
EPSS history
Timeline
  • 03 SEP 10:09Z
    Unauthorized Modification Vulnerability
    cvelistv5