CVE-2024-24496
Published: 08 February 2024
Summary
CVE-2024-24496 is a critical-severity Improper Authentication (CWE-287) vulnerability in Remyandrade Daily Habit Tracker. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 2.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-24496 is a broken access control vulnerability, also involving improper authentication, that affects Daily Habit Tracker version 1.0. The flaw resides in the home.php, add-tracker.php, delete-tracker.php, and update-tracker.php components and carries a CVSS 3.1 base score of 9.8.
Unauthenticated remote attackers can exploit the issue over the network to manipulate trackers, resulting in full compromise of confidentiality, integrity, and availability. The associated EPSS score stands at 0.3398 with no material increase after disclosure.
Public references consist of technical write-ups demonstrating the access-control bypass but contain no vendor advisories, patches, or mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-21915
Vulnerability details
An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php, update-tracker.php components.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
The awareness and training policy mandates training on access control practices, directly reducing the likelihood of improper access control weaknesses being introduced or exploited.
Training covers access control policies and the consequences of improper access grants or usage by users.
Security training teaches access control policies and enforcement, reducing improper access control implementations.
Provides capability to review session content, directly detecting violations of access control.
System audit review detects violations of access controls by identifying unauthorized access attempts.
Control assessments verify that access controls are implemented correctly and operating as intended, detecting improper access control before exploitation.
Requiring formal approval, documented controls, and responsibilities for inter-system exchanges directly enforces proper access control between systems.
Penetration testing simulates unauthorized access attempts, directly detecting and enabling remediation of improper access control weaknesses.