CVE-2024-27113

Insecure Direct Object Reference to export Database in SOPlanning before 1.52.02

CVE CVE-2024-27113
Title Insecure Direct Object Reference to export Database in SOPlanning before 1.52.02
Credits
Affected products
Product Affected Unaffected Unknown
Simple Online Planning SO Planning = before 1.52.01 ()
everything else
CVSS
Base score 9.3 - CRITICAL
Attack Vector NETWORK
Attack Complexity> LOW
Attack Requirements NONE
Privileges Required NONE
Confidentiality Impact
Vulnerable system HIGH Subsequent systems NONE
Integrity Impact
Vulnerable system HIGH Subsequent systems NONE
Availability Impact
Vulnerable system NONE Subsequent systems NONE
Safety impact NEGLIGIBLE
Automatable YES
Recovery AUTOMATIC
Value Density CONCENTRATED
Vulnerability Response effort MODERATE
Provider Urgency RED
References https://csirt.divd.nl/CVE-2024-27113 ( third-party-advisory )
Problem type(s) CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Impact(s) CAPEC-233 Privilege Escalation
Configuration(s) The public view setting must be enabled.
Date published
Last modified 11 Sep 2024 14:11 UTC

Description

An unauthenticated Insecure Direct Object Reference (IDOR) to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database by exporting it as a CSV file. The vulnerability has been remediated in version 1.52.02. 

Workaround(s)

Disable the public view setting.

JSON version.