CVE-2024-45586

This vulnerability exists due to improper access controls on APIs in the Authentication module of Symphony XTS Web Trading and Mobile Trading platforms (version 2.0.0.1_P160). An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized account take over belonging to other users.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:symphonyfintech:xts_mobile_trader:2.0.0.1:p160:*:*:*:*:*:*
cpe:2.3:a:symphonyfintech:xts_web_trader:2.0.0.1:p160:*:*:*:*:*:*

History

04 Sep 2024, 12:15

Type Values Removed Values Added
Summary
  • (es) Esta vulnerabilidad existe debido a controles de acceso inadecuados en las API del módulo de autenticación de las plataformas Symphony XTS Web Trading y Mobile Trading (versión 2.0.0.1_P160). Un atacante remoto autenticado podría aprovechar esta vulnerabilidad manipulando parámetros a través de una solicitud HTTP, lo que podría provocar la apropiación no autorizada de cuentas pertenecientes a otros usuarios.

03 Sep 2024, 19:55

Type Values Removed Values Added
CWE NVD-CWE-Other
References () https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0281 - () https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0281 - Third Party Advisory
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 8.8
First Time Symphonyfintech
Symphonyfintech xts Mobile Trader
Symphonyfintech xts Web Trader
CPE cpe:2.3:a:symphonyfintech:xts_web_trader:2.0.0.1:p160:*:*:*:*:*:*
cpe:2.3:a:symphonyfintech:xts_mobile_trader:2.0.0.1:p160:*:*:*:*:*:*

03 Sep 2024, 10:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-09-03 10:15

Updated : 2024-09-04 12:15


NVD link : CVE-2024-45586

Mitre link : CVE-2024-45586

CVE.ORG link : CVE-2024-45586


JSON object : View

Products Affected

symphonyfintech

  • xts_web_trader
  • xts_mobile_trader
CWE
NVD-CWE-Other CWE-863

Incorrect Authorization