Unauthorized Access to Sensitive Information via Insufficient Access Controls

CVE-2024-38747

7.5HIGH

Key Information

Vendor: Hitpay Payment Solutions Pte Ltd
Status: Hitpay Payment Gateway For WooCommerce
Vendor: CVE Published:; 13 August 2024

Summary

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HitPay Payment Solutions Pte Ltd HitPay Payment Gateway for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects HitPay Payment Gateway for WooCommerce: from n/a through 4.1.3.

Affected Version(s)

HitPay Payment Gateway for WooCommerce <= 4.1.3

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

High

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published.
Aug 13, 2024
Vulnerability Reserved.
Jun 19, 2024

Collectors

NVD DatabaseMitre Database

Credit

Joshua Chan (Patchstack Alliance)