CVE-2024-45588CWE-863

Information Disclosure Vulnerability

Critical · published September 3, 2024

CVSS v4.0
9.1
EPSS
0%
Percentile
28.9
In the wild
Unconfirmed
What it is

This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Preference module of the application. An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized access and modification of sensitive information belonging to other users.

The record
Technical detail
CVSS v4.0
9.1 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00363 · 28.9th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2024-09-03T10:13Z
EPSS history
Timeline
  • 03 SEP 10:13Z
    Information Disclosure Vulnerability
    cvelistv5