Vulnerabilities > CVE-2024-51559 - Authorization Bypass Through User-Controlled Key vulnerability in 63Moons Aero and Wave 2.0
Attack vector
NETWORK Attack complexity
LOW Privileges required
LOW Confidentiality impact
NONE Integrity impact
HIGH Availability impact
NONE Summary
This vulnerability exists in the Wave 2.0 due to missing authorization check on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter “user_id” through API request URLs which could lead to unauthorized creation, modification and deletion of alerts belonging to other user accounts.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 2 |