CVE-2024-34320

Summary

ProPhoenix Law RMS v2022.2403.3.101 contains an access control flaw that allows unauthenticated users to access sensitive API endpoints, potentially leading to full system compromise. This vulnerability is particularly dangerous because it affects critical administrative functions without requiring any authentication.

Exploitability

The vulnerability is highly exploitable with no preconditions required since attackers can immediately access sensitive API endpoints without authentication, making it a straightforward path to unauthorized system access.

Blast radius

If exploited, this flaw could allow attackers to gain full administrative access to the legal records management system, potentially exposing sensitive client data and enabling complete system takeover across all connected services.

Detection

Monitor for unauthorized access attempts to API endpoints that should require authentication, particularly looking for requests to protected administrative endpoints with no authentication tokens present in the logs.

Prioritized remediation

Upgrade to version 2022.2403.3.102 or later to address the access control issue in sensitive API endpoints.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.