CVE-2024-37775
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
In Sunbird DCIM dcTrack version 9.1.2, incorrect access control allows attackers to create or update tickets with a location that bypasses an RBAC check.
Risk Assessment
The risk is that an unauthorized user can manipulate ticket locations, potentially compromising data integrity and role-based access policies.
Recommendation
It is recommended to immediately update to the latest version of Sunbird DCIM dcTrack and implement additional access validation mechanisms for ticket operations.
Other vulnerabilities in Sunbird DCIM dcTrack
See all- CVE-2024-37776Medium
A cross-site scripting (XSS) vulnerability in Sunbird DCIM dcTrack v9.1.2 allows attackers to inject malicious scripts or HTML on certain admin screens.
- CVE-2024-37774High
A CSRF vulnerability in Sunbird DCIM dcTrack version 9.1.2 allows authenticated attackers to escalate privileges by forcing an administrator to perform sensitive requests on certain admin screens.
- CVE-2024-37773Medium
An HTML injection vulnerability in Sunbird DCIM dcTrack 9.1.2 allows authenticated attackers with administrator privileges to inject arbitrary HTML code in an admin screen.
Original NVD description (English source)
Incorrect access control in Sunbird DCIM dcTrack v9.1.2 allows attackers to create or update a ticket with a location which bypasses an RBAC check.