Vulnerability · Published Sep 4, 2024 · Assigned by GitHub_M

CVE-2024-45050Ringer Server Does Not Check Members When Loading Messages

High 7.1

In plain English

A high-severity missing authorization in New-Ringer-Server from Lif-Platforms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.3%top 72.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Ringer server is the server code for the Ringer messaging app. Prior to version 1.3.1, there is an issue with the messages loading route where Ringer Server does not check to ensure that the user loading the conversation is actually a member of that conversation. This allows any user with a Lif Account to load any conversation between two users without permission. This issue had been patched in version 1.3.1. There is no action required for users. Lif Platforms will update their servers with the patch.

Affected products (as reported)

Vendor	Product	Versions
Lif-Platforms	New-Ringer-Server	< 1.3.1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

https://github.com/Lif-Platforms/New-Ringer-Server/security/advisories/GHSA-cpc7-79cg-qv65 x_refsource_CONFIRM
https://github.com/Lif-Platforms/New-Ringer-Server/commit/ae795ff47b2ac2656ac6a099a0e7954ca7d9ba53 x_refsource_MISC