CVE-2024-11216
Published: 05 March 2025
Summary
CVE-2024-11216 is a high-severity Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) vulnerability in Gov (inferred from references). Its CVSS base score is 7.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Account Discovery (T1087); ranked at the 12.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement).
Deeper analysis
CVE-2024-11216 is an Authorization Bypass Through User-Controlled Key and Exposure of Private Personal Information to an Unauthorized Actor vulnerability in PozitifIK Pik Online. It affects Pik Online versions before 3.1.5 and enables account footprinting and session hijacking. The vulnerability carries a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) and maps to CWE-359 (Exposure of Private Information to an Unauthorized Actor) and CWE-639 (Authorization Bypass Through User-Controlled Key). It was published on 2025-03-05.
An attacker requires low privileges (PR:L) to exploit this issue remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Exploitation allows high-impact confidentiality loss (C:H) through exposure of private personal information to unauthorized actors, alongside low-impact integrity (I:L) and availability (A:L) effects, facilitating account footprinting and session hijacking within the affected scope (S:U).
The USOM advisory at https://www.usom.gov.tr/bildirim/tr-25-0052 provides further details. Affected systems should be updated to Pik Online version 3.1.5 or later to mitigate the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54008
Vulnerability details
Authorization Bypass Through User-Controlled Key, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in PozitifIK Pik Online allows Account Footprinting, Session Hijacking. This issue affects Pik Online: before 3.1.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authorization bypass via user-controlled key and exposure of private information directly enables account footprinting (T1087 Account Discovery) and session hijacking via stolen web session data (T1539 Steal Web Session Cookie).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces authorization decisions on user-supplied keys to block the IDOR-style bypass that enables unauthorized access to private data.
Enforces information-flow rules that would stop private personal data from being returned to an actor whose attributes do not satisfy the required policy.
Protects session authenticity so that a hijacked session obtained via the exposed private information cannot be used to maintain unauthorized access.