CVE-2024-50617
HIGH EPSS 14.0%
Published Feb 11, 20264mo ago · Modified Feb 13, 20264mo ago
7.5 CVSS 3.1
Published Feb 11, 2026 4mo ago
Last Modified Feb 13, 2026 4mo ago
Description
Vulnerabilities in the File Download and Get File handler components in CIPPlanner CIPAce before 9.17 allow attackers to download unauthorized files. An authenticated user can easily change the file id parameter or pass the physical file path in the URL query string to retrieve the files. (Retrieval is not intended without correct data access configured for documents.)
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None
Threat Intelligence
EPSS Exploit Probability
14.0% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-285
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| cipplanner | cipace | * | <9.17 |
References 1
- cipplanner.com https://cipplanner.com/cve-2024-50617-cve-public-notification-of-resolution/
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.