PT-2024-25: Improper Authorization leads to sensitive data access in UniPORT E-slip
Vendor: INPAS SOFT
Vulnerable product: UniPORT E-slip
Vulnerable version: 1.4.0.0 and lower
Vulnerability type:
• CWE-285: Improper Authorization
Identifier (ID):
• BDU:2024-04836
Vulnerability vector:
• Base vulnerability score (CVSSv3.1): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Severity (CVSSv3.1): 5.3(medium)
• Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
• Severity (CVSSv4.0): 6.9(medium)
Description:
The vulnerability was identified in UniPORT E-slip (1.4.0.0 and lower).
The discovered vulnerability is caused by insufficient input data validation.
It can be exploited by an attacker to gain access to sensitive application data.
The vulnerability is unexploitable in versions 1.4.0.0 and higher.
Vulnerability status: Confirmed by vendor
Date of vulnerability remediation: 14.06.2024
Recommendations:
• Update to latest version ESLIP 1.6.x.x.