CVE-2024-56902

CVE-2024-56902 is an information disclosure vulnerability in the Geovision GV-ASManager web application, affecting versions v6.1.0.0 and earlier. Classified under CWE-200, the issue enables the exposure of account information, including cleartext passwords. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with network accessibility and no prerequisites for authentication or user interaction.

A remote, unauthenticated attacker can exploit this vulnerability by accessing the affected web application over the network. Exploitation requires low complexity and no user interaction, allowing the attacker to retrieve sensitive account details, such as usernames and plaintext passwords, which could facilitate unauthorized access to the GV-ASManager system or related resources.

Mitigation guidance and additional technical details are available in the advisory published on GitHub at https://github.com/DRAGOWN/CVE-2024-56902.