CVE-2024-12123
Description
A hidden field manipulation vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. When an authenticated user submits a ticket, the request can be intercepted and subsequently modified by using a proxy. The ticket requester can be changed from the original requester to another user in the same application, which the application then accepts.
Is your site exposed to CVE-2024-12123?
Run a free security scan — no signup, results in seconds.
Weakness Type (CWE)
References
Other References
Frequently Asked Questions
What is CVE-2024-12123? +
How do I check if I'm vulnerable to CVE-2024-12123? +
Related Vulnerabilities
SendQuick Entera devices before 11HF5 are vulnerable to CAPTCHA bypass by removing the Captcha parameter.
FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the …
QTS, QuTS hero, QuTScloud are not affected. We have already fixed the vulnerability in the following version:
UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such …
fblog through 983bede allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset …
Hashview 0.8.1 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends …