CVE-2024-51560

Description

This vulnerability exists in the Wave 2.0 due to improper exception handling for invalid inputs at certain API endpoint. An authenticated remote attacker could exploit this vulnerability by providing invalid inputs for “userId” parameter in the API request leading to generation of error message containing sensitive information on the targeted system.

Reserved 2024-10-29 | Published 2024-11-04 | Updated 2024-11-04 | Assigner CERT-In

Problem types

CWE-209: Generation of Error Message Containing Sensitive Information

Product status

Default status
unaffected

<1.1.7
affected

Credits

This vulnerability is reported by Mohit Gadiya. finder

References

www.cert-in.org.in/...eid=PUBVLNOTES01&VLCODE=CIVN-2024-0332 third-party-advisory

cve.org (CVE-2024-51560)

nvd.nist.gov (CVE-2024-51560)

Download JSON