Search criteria

2 vulnerabilities found for XTS Mobile Trader by Symphony Fintech

CVE-2024-45586 (GCVE-0-2024-45586)

Vulnerability from nvd – Published: 2024-09-03 10:02 – Updated: 2024-09-04 11:18
VLAI?
Title
Account Take Over Vulnerability
Summary
This vulnerability exists due to improper access controls on APIs in the Authentication module of Symphony XTS Web Trading and Mobile Trading platforms (version 2.0.0.1_P160). An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized account take over belonging to other users.
Severity ?
9.2 (Critical)
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE
  • CWE-863 - Incorrect Authorization
Assigner
References
Impacted products
Vendor Product Version
Symphony Fintech XTS Web Trader Affected: 2.0.0.1_P160
Create a notification for this product.
Credits
This vulnerability is reported by Mohit Gadiya
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:symphonyfintech:xts_web_trader:2.0.0.1_p160:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "xts_web_trader",
            "vendor": "symphonyfintech",
            "versions": [
              {
                "status": "affected",
                "version": "2.0.0.1_p160"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:symphonyfintech:xts_mobile_trader:2.0.0.1_p160:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "xts_mobile_trader",
            "vendor": "symphonyfintech",
            "versions": [
              {
                "status": "affected",
                "version": "2.0.0.1_p160"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45586",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T17:36:05.971902Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T17:38:44.515Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "XTS Web Trader",
          "vendor": "Symphony Fintech",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.0.1_P160"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "XTS Mobile Trader",
          "vendor": "Symphony Fintech",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.0.1_P160"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This vulnerability is reported by Mohit Gadiya"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This vulnerability exists due to improper access controls on APIs in the Authentication module of Symphony XTS Web Trading and Mobile Trading platforms (version 2.0.0.1_P160). An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized account take over belonging to other users.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "This vulnerability exists due to improper access controls on APIs in the Authentication module of Symphony XTS Web Trading and Mobile Trading platforms (version 2.0.0.1_P160). An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized account take over belonging to other users."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-04T11:18:59.113Z",
        "orgId": "66834db9-ab24-42b4-be80-296b2e40335c",
        "shortName": "CERT-In"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2024-0281"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade Symphony XTS Web Trader to version 2.0.0.1_P160_1 and\u003cbr\u003eSymphony XTS Mobile Trader to version 2.0.0.1_P160_1\u003cbr\u003e"
            }
          ],
          "value": "Upgrade Symphony XTS Web Trader to version 2.0.0.1_P160_1 and\nSymphony XTS Mobile Trader to version 2.0.0.1_P160_1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Account Take Over Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "66834db9-ab24-42b4-be80-296b2e40335c",
    "assignerShortName": "CERT-In",
    "cveId": "CVE-2024-45586",
    "datePublished": "2024-09-03T10:02:29.682Z",
    "dateReserved": "2024-09-02T12:11:40.611Z",
    "dateUpdated": "2024-09-04T11:18:59.113Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-45586 (GCVE-0-2024-45586)

Vulnerability from cvelistv5 – Published: 2024-09-03 10:02 – Updated: 2024-09-04 11:18
VLAI?
Title
Account Take Over Vulnerability
Summary
This vulnerability exists due to improper access controls on APIs in the Authentication module of Symphony XTS Web Trading and Mobile Trading platforms (version 2.0.0.1_P160). An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized account take over belonging to other users.
Severity ?
9.2 (Critical)
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE
  • CWE-863 - Incorrect Authorization
Assigner
References
Impacted products
Vendor Product Version
Symphony Fintech XTS Web Trader Affected: 2.0.0.1_P160
Create a notification for this product.
Credits
This vulnerability is reported by Mohit Gadiya
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:symphonyfintech:xts_web_trader:2.0.0.1_p160:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "xts_web_trader",
            "vendor": "symphonyfintech",
            "versions": [
              {
                "status": "affected",
                "version": "2.0.0.1_p160"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:symphonyfintech:xts_mobile_trader:2.0.0.1_p160:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "xts_mobile_trader",
            "vendor": "symphonyfintech",
            "versions": [
              {
                "status": "affected",
                "version": "2.0.0.1_p160"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45586",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T17:36:05.971902Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T17:38:44.515Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "XTS Web Trader",
          "vendor": "Symphony Fintech",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.0.1_P160"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "XTS Mobile Trader",
          "vendor": "Symphony Fintech",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.0.1_P160"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This vulnerability is reported by Mohit Gadiya"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This vulnerability exists due to improper access controls on APIs in the Authentication module of Symphony XTS Web Trading and Mobile Trading platforms (version 2.0.0.1_P160). An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized account take over belonging to other users.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "This vulnerability exists due to improper access controls on APIs in the Authentication module of Symphony XTS Web Trading and Mobile Trading platforms (version 2.0.0.1_P160). An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized account take over belonging to other users."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-04T11:18:59.113Z",
        "orgId": "66834db9-ab24-42b4-be80-296b2e40335c",
        "shortName": "CERT-In"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2024-0281"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade Symphony XTS Web Trader to version 2.0.0.1_P160_1 and\u003cbr\u003eSymphony XTS Mobile Trader to version 2.0.0.1_P160_1\u003cbr\u003e"
            }
          ],
          "value": "Upgrade Symphony XTS Web Trader to version 2.0.0.1_P160_1 and\nSymphony XTS Mobile Trader to version 2.0.0.1_P160_1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Account Take Over Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "66834db9-ab24-42b4-be80-296b2e40335c",
    "assignerShortName": "CERT-In",
    "cveId": "CVE-2024-45586",
    "datePublished": "2024-09-03T10:02:29.682Z",
    "dateReserved": "2024-09-02T12:11:40.611Z",
    "dateUpdated": "2024-09-04T11:18:59.113Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}