CVE-2024-12123

A hidden field manipulation vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user.  When an authenticated user submits a ticket, the request can be intercepted and subsequently modified by using a proxy.  The ticket requester can be changed from the original requester to another user in the same application, which the application then accepts.

A hidden field manipulation vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user.  When an authenticated user submits a ticket, the request can be intercepted and subsequently modified by using a proxy.  The ticket requester can be changed from the original requester to another user in the same application, which the application then accepts.

Se identificó una vulnerabilidad de manipulación de campos ocultos en la versión 17.1 de Issuetrak que podría ser activada por un usuario autenticado. Cuando un usuario autenticado envía un ticket, la solicitud puede ser interceptada y posteriormente modificada mediante un proxy. El solicitante del ticket puede cambiar de solicitante original a otro usuario en la misma aplicación, que luego la aplicación acepta.