CVE-2024-47089CWE-354

Unauthorized Transaction Manipulation Vulnerability

High · published September 19, 2024

CVSS v4.0
8.7
EPSS
0%
Percentile
12.7
In the wild
Unconfirmed
What it is

This vulnerability exists in the Apex Softcell LD Geo due to improper validation of the transaction token ID in the API endpoint. An authenticated remote attacker could exploit this vulnerability by manipulating the transaction token ID in the API request leading to unauthorized access and modification of transactions belonging to other users.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N
EPSS
0.00227 · 12.7th percentile
Weakness
CWE-354 · Improper Validation of Integrity Check Value
Published
2024-09-19T06:18Z
EPSS history
Timeline
  • 19 SEP 06:18Z
    Unauthorized Transaction Manipulation Vulnerability
    cvelistv5