CVE-2024-51559

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-51559
This vulnerability exists in the Wave 2.0 due to improper authorization checks on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters to gain unauthorized access and perform malicious activities on other user accounts.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332 Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:63moons:aero:*:*:*:*:*:*:*:*
cpe:2.3:a:63moons:wave_2.0:*:*:*:*:*:*:*:*
History

22 Nov 2024, 12:15

Type Values Removed Values Added
Summary (en) This vulnerability exists in the Wave 2.0 due to missing authorization check on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter “user_id” through API request URLs which could lead to unauthorized creation, modification and deletion of alerts belonging to other user accounts. (en) This vulnerability exists in the Wave 2.0 due to improper authorization checks on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters to gain unauthorized access and perform malicious activities on other user accounts.

08 Nov 2024, 15:19

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
References () https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332 - () https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332 - Third Party Advisory
Summary
  • (es) Esta vulnerabilidad existe en Wave 2.0 debido a la falta de verificación de autorización en ciertos endpoints de API. Un atacante remoto autenticado podría aprovechar esta vulnerabilidad manipulando un parámetro “user_id” a través de las URL de solicitud de API, lo que podría provocar la creación, modificación y eliminación no autorizadas de alertas pertenecientes a otras cuentas de usuario.
First Time 63moons wave 2.0
63moons aero
63moons
CPE cpe:2.3:a:63moons:aero:*:*:*:*:*:*:*:*
cpe:2.3:a:63moons:wave_2.0:*:*:*:*:*:*:*:*

04 Nov 2024, 13:17

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-04 13:17

Updated : 2024-11-22 12:15

NVD link : CVE-2024-51559

Mitre link : CVE-2024-51559

CVE.ORG link : CVE-2024-51559

JSON object : View

Products Affected

63moons

  • wave_2.0
  • aero
CWE
CWE-639

Authorization Bypass Through User-Controlled Key