CVE-2024-10469 CERT/CC VINCE versions before 3.0.9 allows authenticated user to access User Management view.
Authenticated users can improperly access the User Management view, exposing sensitive user information in CERT/CC VINCE.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-10469?
CVE-2024-10469 is a medium-severity missing authorization vulnerability in CERT/CC VINCE, published on 28 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users.
Weakness: CWE-276
Which versions are affected by CVE-2024-10469?
It affects 1 product.
Products include Cert Vince.
How do I fix CVE-2024-10469?
No fix has been published for CVE-2024-10469 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-10469 being exploited?
There is no known exploitation of CVE-2024-10469 in the wild and no public exploit code.
Other vulnerabilities in CERT/CC VINCE
- CVE-2022-40238 A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5
- CVE-2022-25799 An open redirect vulnerability exists in CERT/CC VINCE software prior to version 1.50.0
- CVE-2022-40248 An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4
- CVE-2022-40257 An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4
- CVE-2024-9953 Potential DoS Vulnerability in CERT VINCE Software Before Version 3.0.8
Sources
Also known as GHSA-59xx-g8cv-87qw.