Vulnerability · Published Sep 3, 2024 · Assigned by CERT-In

CVE-2024-45586Account Take Over Vulnerability

Critical 9.2

In plain English

A critical-severity incorrect authorization in XTS Mobile Trader from Symphony Fintech. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 4.0)9.2Critical

Exploit odds (30 days)0.4%top 62.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

This vulnerability exists due to improper access controls on APIs in the Authentication module of Symphony XTS Web Trading and Mobile Trading platforms (version 2.0.0.1_P160). An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized account take over belonging to other users.

Affected products (as reported)

Vendor	Product	Versions
Symphony Fintech	XTS Web Trader	2.0.0.1_P160
Symphony Fintech	XTS Mobile Trader	2.0.0.1_P160

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0281 third-party-advisory