CVE-2024-34323
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request.
Risk Assessment
An attacker can access data belonging to other users or resources they are not authorized to view, potentially leading to information disclosure.
Recommendation
Update ProPhoenix Law RMS to a patched version or contact the vendor; enforce server-side access control for resource-identifying parameters.
Other vulnerabilities in ProPhoenix Law RMS
See all- CVE-2024-34324Critical
An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie.
- CVE-2024-34320Critical
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.
- CVE-2024-34326Medium
The vulnerability in ProPhoenix Law RMS version v2022.2403.3.101 is a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Alert/MsgType parameter in the errorHandler.aspx endpoint.
- CVE-2024-34321Medium
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Notes parameter in the Notes.aspx endpoint.
- CVE-2024-34319Medium
A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to make unintended DNS and web requests via a crafted HTTP request.
Original NVD description (English source)
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS