CVE-2024-31842
First published: Tue Aug 20 2024(Updated: )
An issue was discovered in Italtel Embrace 1.6.4. The web application inserts the access token of an authenticated user inside GET requests. The query string for the URL could be saved in the browser's history, passed through Referers to other web sites, stored in web logs, or otherwise recorded in other sources. If the query string contains sensitive information such as session identifiers, then attackers can use this information to launch further attacks. Because the access token in sent in GET requests, this vulnerability could lead to complete account takeover.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Italtel Embrace | =1.6.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-31842?
CVE-2024-31842 has a moderate severity level due to potential exposure of sensitive access tokens in GET requests.
How do I fix CVE-2024-31842?
To mitigate CVE-2024-31842, avoid using GET requests to transmit access tokens and switch to POST requests where possible.
Which software versions are affected by CVE-2024-31842?
CVE-2024-31842 specifically affects Italtel Embrace version 1.6.4.
What are the potential risks of CVE-2024-31842?
The risks of CVE-2024-31842 include the exposure of sensitive user information through browser history and logs.
Can CVE-2024-31842 lead to account compromise?
Yes, if access tokens are exposed, CVE-2024-31842 can potentially lead to unauthorized account access.
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/event
- agent/severity
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/weakness
- agent/last-modified-date
- agent/tags
- agent/source
- vendor/italtel
- canonical/italtel embrace
- version/italtel embrace/1.6.4