What is CVE-2024-45586?

CVE-2024-45586 is a high-severity vulnerability in Symphony Fintech Xts Mobile Trader, classified under Incorrect Authorization. CVSS score: 8.8/10. Published 2024-09-03.

How severe is CVE-2024-45586?

High severity. CVSS v3 base score is 8.8 out of 10.

Auth bypass in Symphony Fintech Xts Mobile Trader

CVE-2024-45586

This vulnerability exists due to improper access controls on APIs in the Authentication module of Symphony XTS Web Trading and Mobile Trading platforms (version 2.0.0.1_P160). An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized account take over belonging to other users.

Vulnerability class: Broken Access Control

EPSS: 0.004 (35.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Symphony Fintech Xts Mobile Trader — versions 2.0.0.1_P160
Symphony Fintech Xts Web Trader — versions 2.0.0.1_P160
Symphonyfintech Xts_mobile_trader — versions 2.0.0.1
Symphonyfintech Xts_web_trader — versions 2.0.0.1

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

vdisclose@cert-in.org.in (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2024-45586?: CVE-2024-45586 is a high-severity vulnerability in Symphony Fintech Xts Mobile Trader, classified under Incorrect Authorization. CVSS score: 8.8/10. Published 2024-09-03.
How severe is CVE-2024-45586?: High severity. CVSS v3 base score is 8.8 out of 10.