Skip to main content

Vince CVE-2024-10469

MEDIUM
Incorrect Default Permissions (CWE-276)
2024-10-28 cret@cert.org
Privilege Escalation Vince Cert
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Oct 28, 2024 - 16:15 nvd
MEDIUM 6.5

DescriptionNVD

VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users.

AnalysisAI

VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Incorrect Default Permissions (CWE-276), which allows attackers to access resources due to overly permissive default settings. VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users. Affected products include: Cert Vince. Version information: before 3.0.9.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Set restrictive default permissions, follow principle of least privilege, review defaults during deployment.

More in Vince

View all
CVE-2022-25799 MEDIUM POC
6.1 Aug 16

An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0. Rated medium severity (CVSS 6.1), this

CVE-2026-18749 CRITICAL
9.8 Aug 12

Broken object-level authorization in CERT/CC VINCE (Vulnerability Information and Coordination Environment) before 3.0.4
CVE-2022-40238 HIGH
8.8 Oct 26

A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. Rated high severity (CVSS 8.8), t
CVE-2026-18744 MEDIUM
6.5 Aug 12

Cross-tenant IDOR in CERT/CC's VINCE platform allows any authenticated case participant to read another vendor's embargo
CVE-2026-8142 MEDIUM
6.5 May 07

VINCE versions 3.0.38 and earlier fail to properly verify sender address authenticity due to encoding confusion, allowin
CVE-2022-40257 MEDIUM
5.4 Oct 10

An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. Rated medium severity (CVSS 5.4), this
CVE-2022-40248 MEDIUM
5.4 Oct 10

An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. Rated medium severity (CVSS 5.4), this
CVE-2026-18750 MEDIUM
5.3 Aug 12

Insecure Direct Object Reference (IDOR) in CERT/CC's VINCE coordination platform allows an authenticated vendor admin to
CVE-2024-9953 MEDIUM
4.9 Oct 14

A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. Rated medium se

Same weakness CWE-276 – Incorrect Default Permissions

View all
CVE-2013-0632 CRITICAL POC
9.8
CVE-2017-11610 HIGH POC
8.8
CVE-2022-22948 MEDIUM POC
6.5
CVE-2017-8625 HIGH POC
8.8
CVE-2016-5425 HIGH POC
7.8
CVE-2024-55215 CRITICAL POC
9.8
CVE-2024-57604 CRITICAL POC
9.8
CVE-2024-28056 CRITICAL POC
9.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Share

CVE-2024-10469 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy