Cyber Resilience

CVE-2024-31845

MediumPublic PoC

Published: 21 May 2024

Published
21 May 2024
Modified
21 May 2025
KEV Added
—
Patch
—
CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0016 37.3th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-31845 is a medium-severity Improper Output Neutralization for Logs (CWE-117) vulnerability in Italtel Embrace. Its CVSS base score is 5.3 (Medium).

Operationally, ranked at the 37.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

An issue was discovered in Italtel Embrace 1.6.4. The product does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter. This parameter can be modified by an…

more

attacker, so that every action he performs is attributed to a different user. This can be exploited without authentication.

CWE(s)
CWE-117

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

italtel
embrace
1.6.4

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AU-1 Policy and Procedures
addresses: CWE-117

Policy and procedures require sanitization and neutralization when generating audit logs to avoid injection issues.

SI-15 Information Output Filtering
addresses: CWE-117

Requiring output to conform to expected content prevents unneutralized data from reaching logs.

References