CVE-2024-37889

Medium

Description

MyFinances is a web application for managing finances. MyFinances has a way to access other customer invoices while signed in as a user. This method allows an actor to access PII and financial information from another account. The vulnerability is fixed in 0.4.6.

SeverityMedium

CVSS6.5

Exploit probability—

ProductTreyww Myfinances

PublishedJun 14, 2024

First seenJun 14, 2024

Weakness typeCWE-639Authorization bypass through user-controlled key

How to fix

Update

treyww myfinances0.4.6 or later

Affected products

Product	Affected versions	Fixed in
treyww myfinances	v < 0.4.6	0.4.6

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.