LumisXP 16.1.x Hardcoded Credentials / IDOR

===== Tempest Security Intelligence - ADV-6/2024 ========================== LumisXP v15.0.x to v16.1.x Author: Rodolfo Tavares Tempest Security Intelligence - Recife, Pernambuco - Brazil ===== Table of Contents================================================== Overview Detailed description Timeli...

CVE-2024-33329

A hardcoded privileged ID within Lumisxp v15.0.x to v16.1.x allows attackers to bypass authentication and access internal pages and other sensitive information...

CVE-2024-33329

CVE-2024-33329 affects LumisXP versions v15.0.x–v16.1.x. The issue is a hardcoded privileged ID that enables authentication bypass, allowing access to internal pages and sensitive information. Public references (NVD, Red Hat, CNNVD, PacketStorm) corroborate a credential-based bypass vulnerability...