Reedos Software Solutions Mutual Fund Distribution Product 2.0.1 API Endpoint private personal information

Summaryinfo

A vulnerability classified as problematic was found in Reedos Software Solutions Mutual Fund Distribution Product 2.0.1. Impacted is an unknown function of the component API Endpoint. Such manipulation leads to private personal information. This vulnerability is uniquely identified as CVE-2024-45787. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Reedos Software Solutions Mutual Fund Distribution Product 2.0.1. It has been rated as problematic. Affected by this issue is an unknown function of the component API Endpoint. The manipulation with an unknown input leads to a private personal information vulnerability. Using CWE to declare the problem leads to CWE-359. The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected. Impacted is confidentiality. CVE summarizes:

This vulnerability exists in Reedos aiM-Star version 2.0.1 due to transmission of sensitive information in plain text in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter through API request URL and intercepting response of the API request leading to exposure of sensitive information belonging to other users.

The advisory is shared for download at cert-in.org.in. This vulnerability is handled as CVE-2024-45787 since 09/09/2024. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1589.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Reedos Software Solutions

Name

• Mutual Fund Distribution Product

Version

• 2.0.1

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion