Lucene search

TR-CERTCVE-2024-3306

HistorySep 12, 2024 - 1:15 p.m.

CVE-2024-3306

2024-09-1213:15:12

CWE-639

TR-CERT

web.nvd.nist.gov

cve-2024-3306

utarit information soliclub

authorization bypass

user-controlled key

vulnerability

incorrectly configured access control

security levels

ios

android

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS4

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:L/VI:L/SI:L/VA:N/SA:N

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

18.6%

JSON

Authorization Bypass Through User-Controlled Key vulnerability in Utarit Information SoliClub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android.

Affected configurations

Nvd

Node

utaritsoliclubRange<4.4.0iphone_os

utaritsoliclubRange<5.2.1android

VendorProductVersionCPE
utaritsoliclub*cpe:2.3:a:utarit:soliclub:*:*:*:*:*:iphone_os:*:*
utaritsoliclub*cpe:2.3:a:utarit:soliclub:*:*:*:*:*:android:*:*

Vendor	Product	Version	CPE
utarit	soliclub	*	cpe:2.3:a:utarit:soliclub::::::iphone_os::*
utarit	soliclub	*	cpe:2.3:a:utarit:soliclub::::::android::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SoliClub",
    "vendor": "Utarit Information",
    "versions": [
      {
        "lessThan": "4.4.0",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      },
      {
        "lessThan": "5.2.1",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.usom.gov.tr/bildirim/tr-24-1457

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS4

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:L/VI:L/SI:L/VA:N/SA:N

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

18.6%

JSON

Related for CVE-2024-3306