Cyber Resilience

CVE-2024-55272

High

Published: 07 February 2025

Published
07 February 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0003 10.7th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-55272 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-22 (Publicly Accessible Content) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2024-55272 is a vulnerability in Brainasoft Braina version 2.8 that enables a remote attacker to obtain sensitive information through the chat window function. Classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), it has a CVSS v3.1 base score of 7.5, reflecting high confidentiality impact with network accessibility, low attack complexity, no privileges required, no user interaction, and unchanged scope.

A remote attacker with no authentication or privileges can exploit this issue over the network by targeting the chat window function, potentially extracting sensitive information from the affected system without impacting integrity or availability.

For mitigation details, refer to the advisory at https://github.com/soursec/CVEs/tree/main/CVE-2024-55272, published on 2025-02-07. Security practitioners should check this source for any recommended patches or workarounds specific to Braina v2.8.

EU & UK References

Vulnerability details

An issue in Brainasoft Braina v2.8 allows a remote attacker to obtain sensitive information via the chat window function.

CWE(s)
CWE-200

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

Remote unauthenticated exploitation of chat function enables public app exploit (T1190) for direct sensitive data access from system (T1005).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-22973Shared CWE-200
CVE-2024-43707Shared CWE-200
CVE-2024-13606Shared CWE-200
CVE-2024-13622Shared CWE-200
CVE-2024-13611Shared CWE-200
CVE-2024-13600Shared CWE-200
CVE-2025-26167Shared CWE-200
CVE-2024-13568Shared CWE-200
CVE-2024-13638Shared CWE-200
CVE-2025-24253Shared CWE-200

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the CVE by identifying, reporting, and correcting the specific flaw in the Braina v2.8 chat window that exposes sensitive information.

SI-15 Information Output Filtering good match
prevent

Filters sensitive information from output through the chat window function, preventing remote attackers from obtaining unauthorized disclosures.

AC-22 Publicly Accessible Content good match
prevent

Restricts publicly accessible content in the chat window to exclude sensitive information, blocking exposure to remote unauthenticated attackers.

References