Information Exposure Vulnerability in Netadmin Software NetAdmin IAM
CVE-2024-9513

3.7LOW

Key Information:

Vendor

Netadmin

Status
Netadmin Iam
Vendor
CVE Published:
4 October 2024

What is CVE-2024-9513?

A vulnerability in Netadmin Software's NetAdmin IAM product allows for potential information exposure due to improper handling of HTTP POST requests. Specifically, the issue resides in the file /controller/api/Answer/ReturnUserQuestionsFilled, where manipulation of the 'username' parameter can lead to unauthorized disclosure of sensitive information. The vulnerability can be exploited remotely, and while it is technically challenging to exploit, the risk remains due to public disclosure. The vendor has acknowledged the issue and is currently working on a fix, slated for release in mid-October 2024. Immediate protective measures and awareness are advised for users of affected versions.

References

https://vuldb.com/?id.279212
https://vuldb.com/?ctiid.279212
https://vuldb.com/?submit.413498

EPSS Score

10% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.