CVE-2024-50617

Vulnerabilities in the File Download and Get File handler components in CIPPlanner CIPAce before 9.17 allow attackers to download unauthorized files. An authenticated user can easily change the file id parameter or pass the physical file path in the URL query string to retrieve the files. (Retrieval is not intended without correct data access configured for documents.)

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cipplanner.com/cve-2024-50617-cve-public-notification-of-resolution/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cipplanner:cipace:*:*:*:*:*:*:*:*

History

17 Jun 2026, 08:04

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidades en los componentes manejadores de Descarga de Archivos y Obtener Archivo en CIPPlanner CIPAce anterior a la versión 9.17 permiten a los atacantes descargar archivos no autorizados. Un usuario autenticado puede cambiar fácilmente el parámetro 'file id' o pasar la ruta de archivo física en la cadena de consulta de la URL para recuperar los archivos. (La recuperación no está prevista sin el acceso a datos correcto configurado para los documentos.)

13 Feb 2026, 21:38

Type	Values Removed	Values Added
References	~~() https://cipplanner.com/cve-2024-50617-cve-public-notification-of-resolution/ -~~	() https://cipplanner.com/cve-2024-50617-cve-public-notification-of-resolution/ - Vendor Advisory
CPE		cpe:2.3:a:cipplanner:cipace::::::::
First Time		Cipplanner cipace Cipplanner

12 Feb 2026, 16:16

Type	Values Removed	Values Added
CWE		CWE-285
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5

11 Feb 2026, 22:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-11 22:15

Updated : 2026-06-17 08:04

NVD link : CVE-2024-50617

Mitre link : CVE-2024-50617

CVE.ORG link : CVE-2024-50617

JSON object : View

Products Affected

cipplanner

cipace

CWE

CWE-285

Improper Authorization

{"id": "CVE-2024-50617", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-50617", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-12T15:25:37.112220Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-02-11T22:15:49.877", "references": [{"url": "https://cipplanner.com/cve-2024-50617-cve-public-notification-of-resolution/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "Vulnerabilities in the File Download and Get File handler components in CIPPlanner CIPAce before 9.17 allow attackers to download unauthorized files. An authenticated user can easily change the file id parameter or pass the physical file path in the URL query string to retrieve the files. (Retrieval is not intended without correct data access configured for documents.)"}, {"lang": "es", "value": "Vulnerabilidades en los componentes manejadores de Descarga de Archivos y Obtener Archivo en CIPPlanner CIPAce anterior a la versi\u00f3n 9.17 permiten a los atacantes descargar archivos no autorizados. Un usuario autenticado puede cambiar f\u00e1cilmente el par\u00e1metro 'file id' o pasar la ruta de archivo f\u00edsica en la cadena de consulta de la URL para recuperar los archivos. (La recuperaci\u00f3n no est\u00e1 prevista sin el acceso a datos correcto configurado para los documentos.)"}], "lastModified": "2026-06-17T08:04:49.097", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cipplanner:cipace:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F5F8D48-AC37-455A-A9AC-7950E70027D7", "versionEndExcluding": "9.17"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}