Multiple vulnerabilities in Janto Ticketing Software
Janto Ticketing Software, 4.3r10.cks version.
INCIBE has coordinated the publication of 2 high severity vulnerabilities affecting Janto Ticketing Software version 4.3r10.cks, a ticketing software developed by Impronta, which have been discovered by Alejandro Amorín Niño.
These vulnerabilities have been assigned the following codes, CVSS v3.1 base score, CVSS vector and CWE vulnerability type for each vulnerability:
- CVE-2024-4537: 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | CWE-639
- CVE-2024-4538: 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | CWE-639
The vulnerabilities were fixed by the Impronta team in version 10.cks, released in November 2022.
Following INCIBE's notification of the vulnerability, Impronta has again conducted a thorough review of the service and re-analysed the possible weaknesses of the validation process in the service call, including additional measures in version R11.
- CVE-2024-4537: IDOR vulnerability in Janto Ticketing Software affecting version 4.3r10. This vulnerability could allow a remote user to obtain the download URL of another user to obtain the purchased ticket.
- CVE-2024-4538: IDOR vulnerability in Janto Ticketing Software affecting version 4.3r10. This vulnerability could allow a remote user to obtain a user's event ticket by creating a specific request with the ticket reference ID, leading to the exposure of sensitive user data.
