CVE-2024-4538 HIGH

CVE-2024-4538: IDOR vulnerability in Janto Ticketing Software

Vendor Impronta

Product Janto Ticketing Software

Weakness CWE-639 · IDOR

Published May 7, 2024

Last update August 1, 2024

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

IDOR vulnerability in Janto Ticketing Software affecting version 4.3r10. This vulnerability could allow a remote user to obtain a user's event ticket by creating a specific request with the ticket reference ID, leading to the exposure of sensitive user data.

Key dates

02Disclosure timeline

May 7, 2024 CVE published

August 1, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-4538 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html

Related vulnerabilities

04Related CVE

CVE-2023-42455 Wazuh vulnerable to user privilege escalation CVE-2025-15018 Optional Email <= 1.3.11 - Unauthenticated Privilege Escalation to Account Takeover CVE-2025-8884 IDOR in VHS Electronic Software's ACE Center CVE-2025-12833 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment CVE-2023-53930 ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability