Vulnerability · Published Sep 3, 2024 · Assigned by CERT-In

CVE-2024-45587Unauthorized Modification Vulnerability

Critical 9.1

In plain English

A critical-severity incorrect authorization in XTS Web Trader from Symphony Fintech. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 4.0)9.1Critical

Exploit odds (30 days)0.4%top 63.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Transaction module of vulnerable application. An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to compromise of other user accounts.

Affected products (as reported)

Vendor	Product	Versions
Symphony Fintech	XTS Web Trader	2.0.0.1_P160

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0281 third-party-advisory