CVE-2024-31842: High severity italtel embrace vulnerability
An issue was discovered in Italtel Embrace 1.6.4. The web application inserts the access token of an authenticated user inside GET requests. The query string for the URL could be saved in the browser's history, passed through Referers to other web sites, stored in web logs, or otherwise recorded in other sources. If the query string contains sensitive information such as session identifiers, then attackers can use this information to launch further attacks. Because the access token in sent in GET requests, this vulnerability could lead to complete account takeover.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-31842?
CVE-2024-31842 has a moderate severity level due to potential exposure of sensitive access tokens in GET requests.
How do I fix CVE-2024-31842?
To mitigate CVE-2024-31842, avoid using GET requests to transmit access tokens and switch to POST requests where possible.
Which software versions are affected by CVE-2024-31842?
CVE-2024-31842 specifically affects Italtel Embrace version 1.6.4.
What are the potential risks of CVE-2024-31842?
The risks of CVE-2024-31842 include the exposure of sensitive user information through browser history and logs.
Can CVE-2024-31842 lead to account compromise?
Yes, if access tokens are exposed, CVE-2024-31842 can potentially lead to unauthorized account access.