CVE-2024-38883

During network connection establishment, the Caterease application allows negotiation of less secure encryption algorithms (CWE-757: Selection of Less-Secure Algorithm During Negotiation). An attacker can force both sides of the communication to agree on a weaker protocol or cipher, resulting in a reduction in the actual level of transmission protection. This makes it possible to intercept or manipulate data transmitted between the client and server.

An attacker can gain unauthorized access to sensitive data transmitted by the application and potentially modify it, which threatens both the confidentiality and integrity of communications.

Apply patches available from the vendor according to the references. It is also recommended to configure the network environment to enforce the use of only strong encryption algorithms on the server side, and to monitor network traffic for attempts to negotiate weaker ciphers.

Horizon Business Services Inc. Caterease versions from 16.0.1.1663 to 24.0.1.2405 inclusive and potentially newer versions.