CVE-2024-39341
Last modified
CVE-2024-39341 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. Entrust Instant Financial Issuance (On Premise) Software (formerly known as Cardwizard) 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier leaves behind a configuration file (i.e. WebAPI.cfg.xml) after the installation process. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
Entrust Instant Financial Issuance (On Premise) Software (formerly known as Cardwizard) 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier leaves behind a configuration file (i.e. WebAPI.cfg.xml) after the installation process. This file can be accessed without authentication on HTTP port 80 by guessing the correct IIS webroot path. It includes system configuration parameter names and values with sensitive configuration values encrypted.
Metrics
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-39341?
How severe is CVE-2024-39341?
How do I fix CVE-2024-39341?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-39335Supported versions of Mahara 24.04 before 24.04.1 and 23.04 …9.1
- CVE-2024-39337Click Studios Passwordstate Core before 9.8 build 9858 allow…6.5
- CVE-2024-39338axios 1.7.2 allows SSRF via unexpected behavior where reques…7.5
- CVE-2024-39339A vulnerability has been discovered in all versions of Smart…7.5
- CVE-2024-3934The Mercado Pago payments for WooCommerce plugin for WordPre…6.5
- CVE-2024-39340The authentication system of Securepoint UTM mishandles OTP …8.8
- CVE-2024-39342Entrust Instant Financial Issuance (formerly known as Cardwi…6.6
- CVE-2024-39343An issue was discovered in Samsung Mobile Processor and Wear…7
- CVE-2024-39344An issue was discovered in the Docusign API package 8.142.14…8.1
- CVE-2024-39345AdTran 834-5 HDC17600021F1 (SmartOS 11.1.1.1) devices enable…7.2
- CVE-2024-39347Incorrect default permissions vulnerability in firewall func…5.9
- CVE-2024-39348Download of code without integrity check vulnerability in Ai…7.5
Are you affected by CVE-2024-39341?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST