CVE-2024-37889 MyFinances Allows Unauthorized Access to Other Customer Data
Attackers can access other users' invoices and PII by exploiting missing authorization checks in the MyFinances web application.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-37889?
CVE-2024-37889 is a medium-severity missing authorization vulnerability in TreyWW MyFinances, published on 14 Jun 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MyFinances is a web application for managing finances. MyFinances has a way to access other customer invoices while signed in as a user. This method allows an actor to access PII and financial information from another account. The vulnerability is fixed in 0.4.6.
Weakness: CWE-639
Which versions are affected by CVE-2024-37889?
It affects 1 product.
Products include Treyww Myfinances.
How do I fix CVE-2024-37889?
No fix has been published for CVE-2024-37889 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-37889 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-37889 exists.
Sources
Also known as GHSA-4884-3gvp-3wj2.