CVE-2024-12123 - CVE House
Back to Database
Status published Medium CVE-2024-12123

Unauthorized Modification of Ticket Requester

Vulnerability Description

A hidden field manipulation vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user.  When an authenticated user submits a ticket, the request can be intercepted and subsequently modified by using a proxy.  The ticket requester can be changed from the original requester to another user in the same application, which the application then accepts.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-12123

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Harrison Daley

References

More from Issuetrak

View All →
CVE-2024-11479
Authenticated HTML Injection in Issuetrak Ticket Comment Function
Medium 5.1

Affected Vendor

Affected Software

Issuetrak
Vulnerable Versions:
Issuetrak 17.1

Timeline

Official Publish: December 4th, 2024
Last Modified: December 4th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-472 CWE-837

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.