CVE-2024-52528 CRITICAL

CVE-2024-52528: Auth Token can be passed dummy or wrong the middleware response is 200 OK

Vendor Budgetcontrol
Product Gateway
Weakness CWE-285
Published November 15, 2024
Last update November 15, 2024
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Budget Control Gateway acts as an entry point for incoming requests and routes them to the appropriate microservices for Budget Control. Budget Control Gateway does not properly validate auth tokens, which allows attackers to bypass intended restrictions. This vulnerability is fixed in 1.5.2.

Key dates

02Disclosure timeline

November 15, 2024 CVE published
November 15, 2024 Record updated