CVE-2024-13186
Published: 08 January 2025
Summary
CVE-2024-13186 is a medium-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Vivo (inferred from references). Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2024-13186 is a vulnerability in the MinigameCenter module stemming from insufficient restrictions on loading URLs, which can result in information leakage. This issue is tied to software from Vivo, as detailed in their security advisory. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is classified under CWE-306 (Missing Authentication for Critical Function). It was published on 2025-01-08.
The attack scenario involves unauthenticated remote attackers who can exploit the flaw over the network with low attack complexity and no user interaction required. Exploitation enables high-impact confidentiality violations, allowing attackers to access leaked information without compromising system integrity or availability.
Vivo has published a security advisory addressing this vulnerability, available at https://www.vivo.com/en/support/security-advisory-detail?id=16, which security practitioners should consult for details on patches and mitigation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51408
Vulnerability details
The MinigameCenter module has insufficient restrictions on loading URLs, which may lead to some information leakage.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vuln enables remote unauthenticated exploitation of a public-facing app (T1190) resulting in direct information leakage from the local system (T1005).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses permitting URL loading without identification or authentication in the MinigameCenter module, preventing unauthorized access and information leakage.
Enforces approved access control policies to block unauthenticated requests to load URLs, mitigating the core vulnerability.
Provides protections for public access to limit unauthorized disclosure of information via unrestricted URL loading in the module.