Description
This vulnerability exists due to improper access controls on APIs in the Authentication module of Symphony XTS Web Trading and Mobile Trading platforms (version 2.0.0.1_P160). An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized account take over belonging to other users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Symphony Fintech | XTS Web Trader | 2.0.0.1_P160 | — |
| Symphony Fintech | XTS Mobile Trader | 2.0.0.1_P160 | — |
References
- https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0281 third-party-advisory