CVE-2024-13173
Published: 08 January 2025
Summary
CVE-2024-13173 is a medium-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Vivo (inferred from references). Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2024-13173 is a vulnerability in the health module stemming from insufficient restrictions on loading URLs, which can result in information leakage. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-306 (Missing Authentication for Critical Function). The issue was published on 2025-01-08 and affects components within Vivo software, as detailed in the vendor's security advisory.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables high-impact confidentiality violations, allowing the attacker to access sensitive information through unrestricted URL loading in the health module, while integrity and availability remain unaffected.
Vivo has published a security advisory providing details on the vulnerability at https://www.vivo.com/en/support/security-advisory-detail?id=14, which security practitioners should consult for recommended mitigations and patches.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51399
Vulnerability details
The health module has insufficient restrictions on loading URLs, which may lead to some information leakage.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated exploitation of a public-facing health module via unrestricted URL loading for high-impact information disclosure.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly limits user actions performable without identification or authentication, preventing information leakage from unrestricted URL loading in the unauthenticated health module.
Mandates verification of authorization at public interfaces like the health module prior to allowing access, mitigating unauthenticated exploitation leading to confidentiality violations.
Enforces approved access authorizations for system resources, blocking remote unauthenticated attackers from exploiting the health module's insufficient URL loading restrictions.