What’s Vulnerable › Vulnerabilities

CVE-2024-36426

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-27 · updated 2026-06-17
• Weakness: CWE-319

Description

In TARGIT Decision Suite 23.2.15007.0 before Autumn 2023, the session token is part of the URL and may be sent in a cleartext HTTP session.

Affected products

• Targit Decision Suite 23.2.15007.0: before autumn_2023 — fixed in autumn_2023

How to fix

Upgrade to a fixed version: Targit Decision Suite 23.2.15007.0 autumn_2023. Check the vendor advisory for mitigations.

References

• https://community.targit.com/hc/en-us/articles/12618082416028-Change-Log-On-prem
• https://community.targit.com/hc/en-us/articles/16112758176156-Vulnerabilities
• https://github.com/DMCERTCE/DecisionSuite_Token_in_Url
• https://community.targit.com/hc/en-us/articles/12618082416028-Change-Log-On-prem
• https://github.com/DMCERTCE/DecisionSuite_Token_in_Url

Get alerted when CVE-2024-36426 or the next vulnerability affects your stack