CVE-2024-12123

MEDIUM

Issuetrak 17.1 - Authenticated User Impersonation via Hidden Field Manipulation

Title source: llm

Description

A hidden field manipulation vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. When an authenticated user submits a ticket, the request can be intercepted and subsequently modified by using a proxy. The ticket requester can be changed from the original requester to another user in the same application, which the application then accepts.

References (1)

Core 1

Core References

Various Sources

https://helpcenter.issuetrak.com/home/2340-issuetrak-release-notes

Scores

CVSS v4 5.3

EPSS 0.0035

EPSS Percentile 27.1%

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-472 CWE-837

Status published

Products (1)

Issuetrak/Issuetrak Issuetrak 17.1

Published Dec 04, 2024

Tracked Since Feb 18, 2026