CVE-2024-9671 System: pdf invoices of the developer users can be seen if the url is known
Attackers can view developer PDF invoices without authentication if they know or guess the URL, exposing sensitive billing data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-9671?
CVE-2024-9671 is a medium-severity missing authorization vulnerability in Red Hat 3scale API Management Platform 2, published on 9 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in 3Scale. There is no auth mechanism to see a PDF invoice of a Developer user if the URL is known. Anyone can see the invoice if the URL is known or guessed.
Weakness: CWE-862
Which versions are affected by CVE-2024-9671?
It affects 1 product.
Products include Redhat 3scale Api Management Platform.
How do I fix CVE-2024-9671?
No fix has been published for CVE-2024-9671 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-9671 being exploited?
There is no known exploitation of CVE-2024-9671 in the wild and no public exploit code.
Other vulnerabilities in Red Hat 3scale API Management Platform 2
Sources
Also known as GHSA-5x39-cc3p-mj36.