CVE-2024-45871 Missing authorization in n/a

Medium 6.3 Published 3 Oct 2024 Updated 3 Oct 2024

Incorrect access control in BandiView allows attackers to cause a denial of service condition.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-45871?

CVE-2024-45871 is a medium-severity missing authorization vulnerability in n/a, published on 3 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Bandisoft BandiView 7.05 is Incorrect Access Control via sub_0x232bd8 resulting in denial of service (DOS).

Weakness: CWE-20

Which versions are affected by CVE-2024-45871?

It affects 1 product.

Products include Bandisoft Bandiview.

How do I fix CVE-2024-45871?

No fix has been published for CVE-2024-45871 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-45871 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-45871 exists.

Sources

Also known as GHSA-8mx7-3ccx-q5cq.