CVE-2024-50619 - Vulnerability Analysis

Overview

CIPPlanner CIPAce < 9.17 contains a broken access control vulnerability caused by insufficient validation of user ID and role modification in My Account and User Management components, letting low-privileged authenticated users escalate privileges and access other accounts.

Severity & Score

Impact

Low-privileged authenticated users can access other accounts and escalate their privileges, compromising system integrity and user data.

Mitigation

Update to version 9.17 or later.

References

• https://cipplanner.com/cve-2024-50619-cve-public-notification-of-resolution/

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner