Biletiva Ticketing Platform
Monthly
Unauthenticated abuse of client-trusted logic in the Biletiva Ticketing Platform lets remote attackers bypass security and authorization checks that exist only in the browser client, then directly manipulate server-side state such as ticket, order, or pricing data. The flaw (CWE-602) carries a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L), meaning no credentials, no user interaction, and only ordinary request tampering are needed to reach the integrity-critical impact, while confidentiality and availability effects remain limited. Exploitation is constrained chiefly by the product's narrow deployment footprint rather than by any technical barrier, and no public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported to national authorities by TR-CERT.
Unauthenticated abuse of client-trusted logic in the Biletiva Ticketing Platform lets remote attackers bypass security and authorization checks that exist only in the browser client, then directly manipulate server-side state such as ticket, order, or pricing data. The flaw (CWE-602) carries a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L), meaning no credentials, no user interaction, and only ordinary request tampering are needed to reach the integrity-critical impact, while confidentiality and availability effects remain limited. Exploitation is constrained chiefly by the product's narrow deployment footprint rather than by any technical barrier, and no public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported to national authorities by TR-CERT.