CVE-2024-12123

Katalog CVE

CVSS 5.3 · Medium EPSS 0,38%

Kerentanan External Control of Assumed-Immutable Web Parameter. Skor CVSS 4.0 5.3 (Medium) menurut CNA.

Deskripsi (NVD)

A hidden field manipulation vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user.  When an authenticated user submits a ticket, the request can be intercepted and subsequently modified by using a proxy.  The ticket requester can be changed from the original requester to another user in the same application, which the application then accepts.

Rincian

Terbit di NVD

4 Desember 2024

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 4.0

5.3 (Medium), sumber CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-472: External Control of Assumed-Immutable Web Parameter
CWE-837: Improper Enforcement of a Single, Unique Action

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 29,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://helpcenter.issuetrak.com/home/2340-issuetrak-release-notes