CVE-2024-45786 HIGH

CVE-2024-45786: Improper Authorization Vulnerability

Vendor Reedos Software Solutions
Product Mutual Fund Distribution Product (aiM-Star)
Weakness CWE-639 · IDOR
Published September 11, 2024
Last update September 11, 2024
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

What the vulnerability does

01Description

This vulnerability exists in Reedos aiM-Star version 2.0.1 due to improper access controls on its certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter through API request URL which could lead to gain unauthorized access to sensitive information belonging to other users.

Key dates

02Disclosure timeline

September 11, 2024 CVE published
September 11, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-24487 Growatt Cloud portal Authorization Bypass Through User-Controlled Key CVE-2026-44731 OpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetings via "invited_user_id" in GET parameter "filters" leads to user names disclosure CVE-2022-2312 Student Result or Employee Database < 1.7.5 - Stored Cross Site Scripting via CSRF CVE-2026-2104 Authorization Bypass Through User-Controlled Key in GitLab CVE-2024-12061 Events Addon for Elementor <= 2.2.3 - Authenticated (Contributor+) Post Disclosure