CVE-2024-12123

A hidden field manipulation vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. When an authenticated user submits a ticket, the request can be intercepted and subsequently modified by using a proxy. The ticket requester can be changed from the original requester to another user in the same application, which the application then accepts.

CVSS

No CVSS.

References

Link	Resource
https://helpcenter.issuetrak.com/home/2340-issuetrak-release-notes

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) Se identificó una vulnerabilidad de manipulación de campos ocultos en la versión 17.1 de Issuetrak que podría ser activada por un usuario autenticado. Cuando un usuario autenticado envía un ticket, la solicitud puede ser interceptada y posteriormente modificada mediante un proxy. El solicitante del ticket puede cambiar de solicitante original a otro usuario en la misma aplicación, que luego la aplicación acepta.

04 Dec 2024, 04:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-04 04:15

Updated : 2026-04-15 00:35

NVD link : CVE-2024-12123

Mitre link : CVE-2024-12123

CVE.ORG link : CVE-2024-12123

JSON object : View

Products Affected

No product.

CWE

CWE-472

External Control of Assumed-Immutable Web Parameter

CWE-837

Improper Enforcement of a Single, Unique Action

{"id": "CVE-2024-12123", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "b7efe717-a805-47cf-8e9a-921fca0ce0ce", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2024-12-04T04:15:04.430", "references": [{"url": "https://helpcenter.issuetrak.com/home/2340-issuetrak-release-notes", "source": "b7efe717-a805-47cf-8e9a-921fca0ce0ce"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "b7efe717-a805-47cf-8e9a-921fca0ce0ce", "description": [{"lang": "en", "value": "CWE-472"}, {"lang": "en", "value": "CWE-837"}]}], "descriptions": [{"lang": "en", "value": "A hidden field manipulation vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user.\u00a0\n\nWhen an authenticated user submits a ticket, the request can be intercepted and subsequently modified by using a proxy.\u00a0 The ticket requester can be changed from the original requester to another user in the same application, \nwhich the application then accepts."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad de manipulaci\u00f3n de campos ocultos en la versi\u00f3n 17.1 de Issuetrak que podr\u00eda ser activada por un usuario autenticado. Cuando un usuario autenticado env\u00eda un ticket, la solicitud puede ser interceptada y posteriormente modificada mediante un proxy. El solicitante del ticket puede cambiar de solicitante original a otro usuario en la misma aplicaci\u00f3n, que luego la aplicaci\u00f3n acepta."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "b7efe717-a805-47cf-8e9a-921fca0ce0ce"}