CVE-2024-46937

The CVE-2024-46937 entry concerns MFASOFT Secure Authentication Server (SAS) 1.8.x–1.9.x prior to 1.9.040924, where an improper access control (IDOR) allows remote attackers to access user tokens without authentication via the /api-selfportal/get-info-token-properties endpoint. The root cause is ...