CVE-2024-45919
MEDIUM EPSS 23.9%
Published Oct 7, 20241y ago · Modified Jun 17, 20261w ago
6.5 CVSS 3.1
Published Oct 7, 2024 1y ago
Last Modified Jun 17, 2026 1w ago
Description
A security flaw has been discovered in Solvait version 24.4.2 that allows an attacker to elevate their privileges. By manipulating the Request ID and Action Type parameters in /AssignToMe/SetAction, an attacker can bypass approval workflows leading to unauthorized access to sensitive information or approval of fraudulent requests.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Low
Availability None
Threat Intelligence
EPSS Exploit Probability
23.9% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available
Weaknesses 1
CWE-269 Improper Privilege Management Authorization
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| solvait | solvait | 24.4.2 | any |
References 1
- gist.github.com https://gist.github.com/ipxsec/28afaf965389283a68433c7afd54d17a
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.