Vulnerability · Published Sep 11, 2024 · Assigned by DIVD

CVE-2024-27113Insecure Direct Object Reference to export Database in SOPlanning before 1.52.02

Critical 9.3

In plain English

A critical-severity information exposure in SO Planning from Simple Online Planning. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.4%top 63.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An unauthenticated Insecure Direct Object Reference (IDOR) to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database by exporting it as a CSV file. The vulnerability has been remediated in version 1.52.02.

Affected products (as reported)

Vendor	Product	Versions
Simple Online Planning	SO Planning	before 1.52.01

Weakness: CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:N/AU:Y/R:A/V:C/RE:M/U:Red

References

https://csirt.divd.nl/CVE-2024-27113 third-party-advisory