CVE-2024-12123
Medium
Description
A hidden field manipulation vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. When an authenticated user submits a ticket, the request can be intercepted and subsequently modified by using a proxy. The ticket requester can be changed from the original requester to another user in the same application, which the application then accepts.
SeverityMedium
CVSS5.3
Exploit probability—
ProductIssuetrak
PublishedDec 4, 2024
First seenDec 4, 2024
Weakness typeCWE-472CWE-472CWE-837CWE-837
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Issuetrak Issuetrak | Issuetrak 17.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.