CVE-2024-46293

Missing Authentication for Critical Function (CWE-306)

Published: Sep 30, 2024 / Updated: 50d ago

010
CVSS 9.8EPSS 0.04%Critical
CVE info copied to clipboard

Summary

Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Incorrect Access Control. There is a lack of authorization checks for admin operations. Specifically, an attacker can perform admin-level actions without possessing a valid session token. The application does not verify whether the user is logged in as an admin or even check for a session token at all.

Impact

This vulnerability allows an attacker to bypass authentication and perform unauthorized admin-level actions on the system. The potential impacts are severe, as indicated by the CVSS v3.1 base score of 9.8 (Critical). The vulnerability affects confidentiality, integrity, and availability, all rated as HIGH. An attacker could potentially access sensitive medical information, modify or delete critical data, and disrupt the entire medicine ordering system. Given that no authentication is required, this vulnerability could be exploited remotely by unauthenticated attackers, making it a high-priority security risk.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

As of the current information, there is no mention of an available patch for this vulnerability in Sourcecodester Online Medicine Ordering System 1.0. The security team should closely monitor for any updates or patches released by Sourcecodester to address this critical vulnerability.

Mitigation

Until a patch is available, the following mitigation steps are recommended: 1. Immediately disable public access to the admin interface if possible. 2. Implement strong authentication mechanisms for all admin-level operations. 3. Enforce proper session management and token validation for all sensitive functions. 4. Consider implementing IP restrictions for admin access if feasible. 5. Conduct a thorough security audit of the entire application to identify and address any similar vulnerabilities. 6. Monitor system logs for any suspicious activities or unauthorized access attempts. 7. If possible, consider temporarily taking the system offline or restricting its use until proper security measures can be implemented. 8. Educate users about the potential risks and advise them to be cautious with any sensitive information within the system.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-46293

Sep 30, 2024 at 3:15 PM
First Article

Feedly found the first article mentioning CVE-2024-46293. See article

Sep 30, 2024 at 3:21 PM / National Vulnerability Database
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Sep 30, 2024 at 3:21 PM
CVSS

A CVSS base score of 9.8 has been assigned.

Sep 30, 2024 at 7:40 PM / nvd
EPSS

EPSS Score was set to: 0.04% (Percentile: 9.6%)

Oct 1, 2024 at 10:17 AM
Static CVE Timeline Graph

Affected Systems

Sourcecodester
+null more

Attack Patterns

CAPEC-12: Choosing Message Identifier
+null more

News

Vulnerability Summary for the Week of September 30, 2024
High Vulnerabilities Primary Vendor — Product Description Published CVSS Score Source & Patch Info n/a–n/a An issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11. The application exposes a web interface locally. In the worst-case scenario, if the application is remotely accessible, it allows an attacker to execute arbitrary commands with system privilege on the endpoint hosting the application, without any authentication. 2024-09-30 10 CVE-2024-42017 cve@mitre.org cve@mitre.org Cisco–Cisco Data Center Network Manager A vulnerability in the REST API and web UI of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to perform a command injection attack against an affected device. This vulnerability is due to improper user authorization and insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting crafted commands to an affected REST API endpoint or through the web UI. A successful exploit could allow the attacker to execute arbitrary commands on the CLI of a Cisco NDFC-managed device with network-admin privileges. Note: This vulnerability does not affect Cisco NDFC when it is configured for storage area network (SAN) controller deployment. 2024-10-02 9.9 CVE-2024-20432 ykramarz@cisco.com n/a–n/a The WebDAV service in Infinera TNMS (Transcend Network Management System) 19.10.3 allows a low-privileged remote attacker to conduct unauthorized file operations, because of execution with unnecessary privileges.
US-CERT Vulnerability Summary for the Week of September 30, 2024
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High : vulnerabilities with a CVSS base score of 7.0–10.0 Medium : vulnerabilities with a CVSS base score of 4.0–6.9 Low : vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links.
Vulnerability Summary for the Week of September 30, 2024
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High : vulnerabilities with a CVSS base score of 7.0–10.0 Medium : vulnerabilities with a CVSS base score of 4.0–6.9 Low : vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links.
Update Sun Oct 6 22:15:42 UTC 2024
Update Sun Oct 6 22:15:42 UTC 2024
CVE Alert: CVE-2024-46293 - https://www. redpacketsecurity.com/cve_aler t_cve-2024-46293/ # OSINT # ThreatIntel # CyberSecurity # cve_2024_46293
See 8 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI