Vulnerabilites related to utarit - soliclub
Vulnerability from fkie_nvd
Published
2024-09-12 13:15
Modified
2024-09-19 14:43
Summary
Authorization Bypass Through User-Controlled Key vulnerability in Utarit Information SoliClub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android.
Impacted products
Vendor Product Version
utarit soliclub *
utarit soliclub *



{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:utarit:soliclub:*:*:*:*:*:iphone_os:*:*",
                     matchCriteriaId: "8C0F0E2B-91C8-4301-9781-A5EEDA048CAC",
                     versionEndExcluding: "4.4.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:utarit:soliclub:*:*:*:*:*:android:*:*",
                     matchCriteriaId: "35FAC0F0-AD9C-456D-9C8D-FF2DA3173C7F",
                     versionEndExcluding: "5.2.1",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Authorization Bypass Through User-Controlled Key vulnerability in Utarit Information SoliClub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android.",
      },
      {
         lang: "es",
         value: "La vulnerabilidad de omisión de autorización a través de una clave controlada por el usuario en Utarit Information SoliClub permite explotar los niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a SoliClub: antes de 4.4.0 para iOS, antes de 5.2.1 para Android.",
      },
   ],
   id: "CVE-2024-3306",
   lastModified: "2024-09-19T14:43:51.830",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "NONE",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
      cvssMetricV40: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackRequirements: "NONE",
               attackVector: "NETWORK",
               automatable: "NOT_DEFINED",
               availabilityRequirements: "NOT_DEFINED",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityRequirements: "NOT_DEFINED",
               exploitMaturity: "NOT_DEFINED",
               integrityRequirements: "NOT_DEFINED",
               modifiedAttackComplexity: "NOT_DEFINED",
               modifiedAttackRequirements: "NOT_DEFINED",
               modifiedAttackVector: "NOT_DEFINED",
               modifiedPrivilegesRequired: "NOT_DEFINED",
               modifiedSubsequentSystemAvailability: "NOT_DEFINED",
               modifiedSubsequentSystemConfidentiality: "NOT_DEFINED",
               modifiedSubsequentSystemIntegrity: "NOT_DEFINED",
               modifiedUserInteraction: "NOT_DEFINED",
               modifiedVulnerableSystemAvailability: "NOT_DEFINED",
               modifiedVulnerableSystemConfidentiality: "NOT_DEFINED",
               modifiedVulnerableSystemIntegrity: "NOT_DEFINED",
               privilegesRequired: "NONE",
               providerUrgency: "NOT_DEFINED",
               recovery: "NOT_DEFINED",
               safety: "NOT_DEFINED",
               subsequentSystemAvailability: "NONE",
               subsequentSystemConfidentiality: "LOW",
               subsequentSystemIntegrity: "LOW",
               userInteraction: "NONE",
               valueDensity: "NOT_DEFINED",
               vectorString: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
               version: "4.0",
               vulnerabilityResponseEffort: "NOT_DEFINED",
               vulnerableSystemAvailability: "NONE",
               vulnerableSystemConfidentiality: "HIGH",
               vulnerableSystemIntegrity: "LOW",
            },
            source: "iletisim@usom.gov.tr",
            type: "Secondary",
         },
      ],
   },
   published: "2024-09-12T13:15:12.767",
   references: [
      {
         source: "iletisim@usom.gov.tr",
         tags: [
            "Broken Link",
         ],
         url: "https://www.usom.gov.tr/bildirim/tr-24-1457",
      },
   ],
   sourceIdentifier: "iletisim@usom.gov.tr",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-639",
            },
         ],
         source: "iletisim@usom.gov.tr",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-09-12 13:15
Modified
2024-09-19 14:44
Summary
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Utarit Information SoliClub allows Retrieve Embedded Sensitive Data.This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android.
Impacted products
Vendor Product Version
utarit soliclub *
utarit soliclub *



{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:utarit:soliclub:*:*:*:*:*:iphone_os:*:*",
                     matchCriteriaId: "8C0F0E2B-91C8-4301-9781-A5EEDA048CAC",
                     versionEndExcluding: "4.4.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:utarit:soliclub:*:*:*:*:*:android:*:*",
                     matchCriteriaId: "35FAC0F0-AD9C-456D-9C8D-FF2DA3173C7F",
                     versionEndExcluding: "5.2.1",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Utarit Information SoliClub allows Retrieve Embedded Sensitive Data.This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de exposición de información confidencial a un actor no autorizado en Utarit Information SoliClub permite recuperar datos confidenciales integrados. Este problema afecta a SoliClub: antes de 4.4.0 para iOS, antes de 5.2.1 para Android.",
      },
   ],
   id: "CVE-2024-3305",
   lastModified: "2024-09-19T14:44:28.980",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
      cvssMetricV40: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackRequirements: "NONE",
               attackVector: "NETWORK",
               automatable: "NOT_DEFINED",
               availabilityRequirements: "NOT_DEFINED",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityRequirements: "NOT_DEFINED",
               exploitMaturity: "NOT_DEFINED",
               integrityRequirements: "NOT_DEFINED",
               modifiedAttackComplexity: "NOT_DEFINED",
               modifiedAttackRequirements: "NOT_DEFINED",
               modifiedAttackVector: "NOT_DEFINED",
               modifiedPrivilegesRequired: "NOT_DEFINED",
               modifiedSubsequentSystemAvailability: "NOT_DEFINED",
               modifiedSubsequentSystemConfidentiality: "NOT_DEFINED",
               modifiedSubsequentSystemIntegrity: "NOT_DEFINED",
               modifiedUserInteraction: "NOT_DEFINED",
               modifiedVulnerableSystemAvailability: "NOT_DEFINED",
               modifiedVulnerableSystemConfidentiality: "NOT_DEFINED",
               modifiedVulnerableSystemIntegrity: "NOT_DEFINED",
               privilegesRequired: "NONE",
               providerUrgency: "NOT_DEFINED",
               recovery: "NOT_DEFINED",
               safety: "NOT_DEFINED",
               subsequentSystemAvailability: "LOW",
               subsequentSystemConfidentiality: "LOW",
               subsequentSystemIntegrity: "LOW",
               userInteraction: "NONE",
               valueDensity: "NOT_DEFINED",
               vectorString: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
               version: "4.0",
               vulnerabilityResponseEffort: "NOT_DEFINED",
               vulnerableSystemAvailability: "NONE",
               vulnerableSystemConfidentiality: "HIGH",
               vulnerableSystemIntegrity: "LOW",
            },
            source: "iletisim@usom.gov.tr",
            type: "Secondary",
         },
      ],
   },
   published: "2024-09-12T13:15:12.540",
   references: [
      {
         source: "iletisim@usom.gov.tr",
         tags: [
            "Broken Link",
         ],
         url: "https://www.usom.gov.tr/bildirim/tr-24-1457",
      },
   ],
   sourceIdentifier: "iletisim@usom.gov.tr",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-200",
            },
         ],
         source: "iletisim@usom.gov.tr",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "NVD-CWE-noinfo",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

cve-2024-3306
Vulnerability from cvelistv5
Published
2024-09-12 13:06
Modified
2024-09-12 19:10
Summary
Authorization Bypass Through User-Controlled Key vulnerability in Utarit Information SoliClub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android.
Impacted products
Vendor Product Version
Utarit Information SoliClub Version: 0   < 4.4.0
Version: 0   < 5.2.1
Show details on NVD website


{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:utarit:soliclub:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "soliclub",
                  vendor: "utarit",
                  versions: [
                     {
                        lessThan: "4.4.0",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "5.2.1",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-3306",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-12T19:09:09.452416Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-12T19:10:03.125Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "SoliClub",
               vendor: "Utarit Information",
               versions: [
                  {
                     lessThan: "4.4.0",
                     status: "affected",
                     version: "0",
                     versionType: "custom",
                  },
                  {
                     lessThan: "5.2.1",
                     status: "affected",
                     version: "0",
                     versionType: "custom",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "Mustafa Anıl YILDIRIM",
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "Authorization Bypass Through User-Controlled Key vulnerability in Utarit Information SoliClub allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android.</p>",
                  },
               ],
               value: "Authorization Bypass Through User-Controlled Key vulnerability in Utarit Information SoliClub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android.",
            },
         ],
         impacts: [
            {
               capecId: "CAPEC-180",
               descriptions: [
                  {
                     lang: "en",
                     value: "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels",
                  },
               ],
            },
         ],
         metrics: [
            {
               cvssV4_0: {
                  Automatable: "NOT_DEFINED",
                  Recovery: "NOT_DEFINED",
                  Safety: "NOT_DEFINED",
                  attackComplexity: "LOW",
                  attackRequirements: "NONE",
                  attackVector: "NETWORK",
                  baseScore: 8.8,
                  baseSeverity: "HIGH",
                  privilegesRequired: "NONE",
                  providerUrgency: "NOT_DEFINED",
                  subAvailabilityImpact: "NONE",
                  subConfidentialityImpact: "LOW",
                  subIntegrityImpact: "LOW",
                  userInteraction: "NONE",
                  valueDensity: "NOT_DEFINED",
                  vectorString: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N",
                  version: "4.0",
                  vulnAvailabilityImpact: "NONE",
                  vulnConfidentialityImpact: "HIGH",
                  vulnIntegrityImpact: "LOW",
                  vulnerabilityResponseEffort: "NOT_DEFINED",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-639",
                     description: "CWE-639 Authorization Bypass Through User-Controlled Key",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-09-12T13:06:12.188Z",
            orgId: "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
            shortName: "TR-CERT",
         },
         references: [
            {
               url: "https://www.usom.gov.tr/bildirim/tr-24-1457",
            },
         ],
         source: {
            advisory: "TR-24-1457",
            defect: [
               "TR-24-1457",
            ],
            discovery: "UNKNOWN",
         },
         title: "IDOR in Utarit Information's SoliClub",
         x_generator: {
            engine: "Vulnogram 0.2.0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
      assignerShortName: "TR-CERT",
      cveId: "CVE-2024-3306",
      datePublished: "2024-09-12T13:06:12.188Z",
      dateReserved: "2024-04-04T12:00:34.676Z",
      dateUpdated: "2024-09-12T19:10:03.125Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2024-3305
Vulnerability from cvelistv5
Published
2024-09-12 13:03
Modified
2024-09-12 18:48
Summary
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Utarit Information SoliClub allows Retrieve Embedded Sensitive Data.This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android.
Impacted products
Vendor Product Version
Utarit Information SoliClub Version: 0   < 4.4.0
Version: 0   < 5.2.1
Show details on NVD website


{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:utarit:soliclub:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "soliclub",
                  vendor: "utarit",
                  versions: [
                     {
                        lessThan: "4.4.0",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "5.2.1",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-3305",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-12T18:45:06.544243Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-12T18:48:41.376Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "SoliClub",
               vendor: "Utarit Information",
               versions: [
                  {
                     lessThan: "4.4.0",
                     status: "affected",
                     version: "0",
                     versionType: "custom",
                  },
                  {
                     lessThan: "5.2.1",
                     status: "affected",
                     version: "0",
                     versionType: "custom",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "Mustafa Anıl YILDIRIM",
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Utarit Information SoliClub allows Retrieve Embedded Sensitive Data.<p>This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android.</p>",
                  },
               ],
               value: "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Utarit Information SoliClub allows Retrieve Embedded Sensitive Data.This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android.",
            },
         ],
         impacts: [
            {
               capecId: "CAPEC-37",
               descriptions: [
                  {
                     lang: "en",
                     value: "CAPEC-37 Retrieve Embedded Sensitive Data",
                  },
               ],
            },
         ],
         metrics: [
            {
               cvssV4_0: {
                  Automatable: "NOT_DEFINED",
                  Recovery: "NOT_DEFINED",
                  Safety: "NOT_DEFINED",
                  attackComplexity: "LOW",
                  attackRequirements: "NONE",
                  attackVector: "NETWORK",
                  baseScore: 8.8,
                  baseSeverity: "HIGH",
                  privilegesRequired: "NONE",
                  providerUrgency: "NOT_DEFINED",
                  subAvailabilityImpact: "LOW",
                  subConfidentialityImpact: "LOW",
                  subIntegrityImpact: "LOW",
                  userInteraction: "NONE",
                  valueDensity: "NOT_DEFINED",
                  vectorString: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:L",
                  version: "4.0",
                  vulnAvailabilityImpact: "NONE",
                  vulnConfidentialityImpact: "HIGH",
                  vulnIntegrityImpact: "LOW",
                  vulnerabilityResponseEffort: "NOT_DEFINED",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-200",
                     description: "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-09-12T13:03:13.863Z",
            orgId: "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
            shortName: "TR-CERT",
         },
         references: [
            {
               url: "https://www.usom.gov.tr/bildirim/tr-24-1457",
            },
         ],
         source: {
            advisory: "TR-24-1457",
            defect: [
               "TR-24-1457",
            ],
            discovery: "UNKNOWN",
         },
         title: "Information Disclosure in Utarit Information's SoliClub",
         x_generator: {
            engine: "Vulnogram 0.2.0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
      assignerShortName: "TR-CERT",
      cveId: "CVE-2024-3305",
      datePublished: "2024-09-12T13:03:13.863Z",
      dateReserved: "2024-04-04T11:53:42.686Z",
      dateUpdated: "2024-09-12T18:48:41.376Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}