VulnerabilityAnalyzed

CVE-2024-50617

Vulnerabilities in the File Download and Get File handler components in CIPPlanner CIPAce before 9.17 allow attackers to download unauthorized files.

HIGH 7.5EPSS 0.24%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Vulnerabilities in the File Download and Get File handler components in CIPPlanner CIPAce before 9.17 allow attackers to download unauthorized files. An authenticated user can easily change the file id parameter or pass the physical file path in the URL query string to retrieve the files. (Retrieval is not intended without correct data access configured for documents.)

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.24% probability · 15th percentile
CISA KEV: Not listed
Weakness: CWE-285
Affected: cipplanner/cipace
Source: cve@mitre.org

References

https://cipplanner.com/cve-2024-50617-cve-public-notification-of-resolution/Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.