CVE-2024-11146 TrueFiling authorization bypass via user-controlled keys
Authenticated users can manipulate client-controlled identifiers to access and modify case information they should not have access to.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-11146?
CVE-2024-11146 is a medium-severity missing authorization vulnerability in i3 Verticals TrueFiling, published on 17 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TrueFiling is a collaborative, web-based electronic filing system where attorneys, paralegals, court reporters and self-represented filers collect public legal documentation into cases. TrueFiling is an entirely cloud-hosted application. Prior to version 3.1.112.19, TrueFiling trusted some client-controlled identifiers passed in URL requests to retrieve information. Platform users must self-register for an account, and once authenticated, could manipulate those identifiers to gain partial access to case information and the ability to partially change user access to case information. This vulnerability was addressed in version 3.1.112.19 and all instances were updated by 2024-11-08.
Which versions are affected by CVE-2024-11146?
It affects 1 product.
Products include I3verticals Truefiling.
How do I fix CVE-2024-11146?
No fix has been published for CVE-2024-11146 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-11146 being exploited?
There is no known exploitation of CVE-2024-11146 in the wild and no public exploit code.
Sources
Also known as GHSA-h44w-w4w4-cjc2.