Skip to content
OpenAdvisories
Medium VA-25-017-01 1 CVE

TrueFiling authorization bypass via user-controlled keys

Published Jan 16, 2025 · Updated Feb 20, 2025 · Revision 2

Vendor: i3 Verticals Product: TrueFiling

Summary

TrueFiling trusts some client-controlled identifiers passed in URL requests to retrieve information. Platform users must self-register for an account, and once authenticated, could manipulate those identifiers to gain partial access to case information and the ability to partially change user access to case information.

Vulnerabilities 1

  • Medium 6.3
    CVE-2024-11146

    TrueFiling authorization bypass via user-controlled keys

    TrueFiling is a collaborative, web-based electronic filing system where attorneys, paralegals, court reporters and self-represented filers collect public legal documentation into cases. TrueFiling is an entirely cloud-hosted application. Prior to version 3.1.…

    i3 Verticals TrueFiling

Revision history

  1. #1.0.1

    Update CVSS

  2. #1.0.0

    Initial publication