CVE-2024-23747

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-23747
The Moderna Sistemas ModernaNet Hospital Management System 2024 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability. This vulnerability resides in the system's handling of user data access through a /Modernanet/LAUDO/LAU0000100/Laudo?id= URI. By manipulating this id parameter, an attacker can gain access to sensitive medical information.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/louiselalanne/CVE-2024-23747 Exploit Third Party Advisory
https://modernasistemas.com.br/sitems/ Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:modernasistemas:modernanet_hospital_management_system_2024:-:*:*:*:*:*:*:*
History

02 Feb 2024, 02:03

Type Values Removed Values Added
First Time Modernasistemas
Modernasistemas modernanet Hospital Management System 2024
CWE CWE-639
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References () https://github.com/louiselalanne/CVE-2024-23747 - () https://github.com/louiselalanne/CVE-2024-23747 - Exploit, Third Party Advisory
References () https://modernasistemas.com.br/sitems/ - () https://modernasistemas.com.br/sitems/ - Product
CPE cpe:2.3:a:modernasistemas:modernanet_hospital_management_system_2024:-:*:*:*:*:*:*:*
Summary
  • (es) Moderna Sistemas ModernaNet Hospital Management System 2024 es susceptible a una vulnerabilidad de referencia directa a objetos inseguros (IDOR). Esta vulnerabilidad reside en el manejo por parte del sistema del acceso a los datos del usuario a través de un /Modernanet/LAUDO/LAU0000100/Laudo?id= URI. Al manipular este parámetro de id, un atacante puede obtener acceso a información médica confidencial.

29 Jan 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-29 14:15

Updated : 2024-02-02 02:03

NVD link : CVE-2024-23747

Mitre link : CVE-2024-23747

CVE.ORG link : CVE-2024-23747

JSON object : View

Products Affected

modernasistemas

  • modernanet_hospital_management_system_2024
CWE
CWE-639

Authorization Bypass Through User-Controlled Key