CVE-2024-11318
Published: 18 November 2024
Summary
CVE-2024-11318 is a high-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Incibe (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 3.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
An IDOR vulnerability tracked as CVE-2024-11318 affects AbsysNet version 2.3.1 and is assigned CWE-639. The flaw resides in the "/cgi-bin/ocap/" endpoint and permits unauthorized access to session identifiers through insecure direct object references.
A remote attacker with no authentication or user interaction can exploit the issue over the network by brute-forcing session identifiers. Successful exploitation yields the session of an unauthenticated user, resulting in high confidentiality impact as reflected in the CVSS 7.5 score.
The sole reference points to an INCIBE advisory that describes the vulnerability but supplies no further mitigation details in the available information. The associated EPSS score has remained flat at 0.2668 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-33727
- 🇪🇸 INCIBE: www.incibe.es
Vulnerability details
An IDOR (Insecure Direct Object Reference) vulnerability has been discovered in AbsysNet, affecting version 2.3.1. This vulnerability could allow a remote attacker to obtain the session of an unauthenticated user by brute-force attacking the session identifier on the "/cgi-bin/ocap/" endpoint.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.