Threat Investigation
Request a demo

CVE-2024-51560

Medium

Description

This vulnerability exists in the Wave 2.0 due to improper exception handling for invalid inputs at certain API endpoint. An authenticated remote attacker could exploit this vulnerability by providing invalid inputs for “userId” parameter in the API request leading to generation of error message containing sensitive information on the targeted system.

SeverityMedium
CVSS4.3
Exploit probability—
Product63moons Wave
PublishedNov 4, 2024
First seenNov 4, 2024
Weakness typeCWE-209CWE-209

How to fix

Update
  • 63moons wave_2.01.1.7 or later
  • 63moons aero120820241550 or later

Affected products

ProductAffected versionsFixed in
63moons wave_2.0v < 1.1.71.1.7
63moons aerov < 120820241550120820241550

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.