Entrust Instant Financial Issuance up to 6.10.0 Configuration Parameter WebAPI.cfg.xml missing authentication

Summaryinfo

A vulnerability has been found in Entrust Instant Financial Issuance up to 6.8.x/6.9.0/6.9.1/6.9.2/6.10.0 and classified as critical. The affected element is an unknown function of the file WebAPI.cfg.xml of the component Configuration Parameter Handler. Performing a manipulation results in missing authentication. This vulnerability is known as CVE-2024-39341. No exploit is available.

Detailsinfo

A vulnerability was found in Entrust Instant Financial Issuance up to 6.8.x/6.9.0/6.9.1/6.9.2/6.10.0. It has been classified as critical. This affects an unknown part of the file WebAPI.cfg.xml of the component Configuration Parameter Handler. The manipulation with an unknown input leads to a missing authentication vulnerability. CWE is classifying the issue as CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. This is going to have an impact on confidentiality. The summary by CVE is:

Entrust Instant Financial Issuance (On Premise) Software (formerly known as Cardwizard) 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier leaves behind a configuration file (i.e. WebAPI.cfg.xml) after the installation process. This file can be accessed without authentication on HTTP port 80 by guessing the correct IIS webroot path. It includes system configuration parameter names and values with sensitive configuration values encrypted.

This vulnerability is uniquely identified as CVE-2024-39341 since 06/24/2024. The exploitability is told to be easy. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

By approaching the search of inurl:WebAPI.cfg.xml it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Financial Software

Vendor

• Entrust

Name

• Instant Financial Issuance

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.8
• 6.9
• 6.9.0
• 6.9.1
• 6.9.2
• 6.10.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion