CVE-2024-37768

An attacker sends an HTTP request to the /api/admin/user?id endpoint with the appropriate user identifier, resulting in the user being deleted from the system. The lack of access control mechanisms in handling this request means that the operation can be performed without possessing administrative privileges or any authentication. The vulnerability is remote in nature and requires no interaction from the victim.

An attacker can permanently delete any user accounts in the system, including administrative accounts, leading to loss of data integrity and potential application unavailability. In extreme cases, it is possible to completely deprive all users of system access.

Apply patches available from the manufacturer according to the references. Temporarily, it is recommended to restrict access to the /api/admin/user endpoint at the firewall or reverse proxy level and enforce strong authentication and authorization controls for all API administrative operations.

14Finger version 1.1 (B1Ackc4T product)