CVE-2024-55272
Published: 07 February 2025
Summary
CVE-2024-55272 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-22 (Publicly Accessible Content) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by identifying, reporting, and correcting the specific flaw in the Braina v2.8 chat window that exposes sensitive information.
Filters sensitive information from output through the chat window function, preventing remote attackers from obtaining unauthorized disclosures.
Restricts publicly accessible content in the chat window to exclude sensitive information, blocking exposure to remote unauthenticated attackers.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated exploitation of chat function enables public app exploit (T1190) for direct sensitive data access from system (T1005).
NVD Description
An issue in Brainasoft Braina v2.8 allows a remote attacker to obtain sensitive information via the chat window function.
Deeper analysisAI
CVE-2024-55272 is a vulnerability in Brainasoft Braina version 2.8 that enables a remote attacker to obtain sensitive information through the chat window function. Classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), it has a CVSS v3.1 base score of 7.5, reflecting high confidentiality impact with network accessibility, low attack complexity, no privileges required, no user interaction, and unchanged scope.
A remote attacker with no authentication or privileges can exploit this issue over the network by targeting the chat window function, potentially extracting sensitive information from the affected system without impacting integrity or availability.
For mitigation details, refer to the advisory at https://github.com/soursec/CVEs/tree/main/CVE-2024-55272, published on 2025-02-07. Security practitioners should check this source for any recommended patches or workarounds specific to Braina v2.8.
Details
- CWE(s)