CVE-2024-31845

An issue was discovered in Italtel Embrace 1.6.4. The product does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter. This parameter can be modified by an attacker, so that every action he performs is attributed to a different user. This can be exploited without authentication.

An issue was discovered in Italtel Embrace 1.6.4. The product does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter. This parameter can be modified by an attacker, so that every action he performs is attributed to a different user. This can be exploited without authentication.

Se descubrió un problema en Italtel Embrace 1.6.4. El producto no neutraliza o neutraliza incorrectamente la salida escrita en los registros. La aplicación web escribe registros utilizando un parámetro de cadena de consulta GET. Este parámetro puede ser modificado por un atacante, de modo que cada acción que realice se atribuya a un usuario diferente. Esto se puede explotar sin autenticación.