{"id":"CVE-2024-34320","published":"2026-10-13T16:17:07.990","lastModified":"2026-10-16T19:56:15.773","description":"ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-284"],"vendors":[],"products":[],"references":[{"url":"https://prophoenix.com/law-rms/","tags":[]},{"url":"https://sedriclouissaint.com/blog/prophoenix-law-rms-authentication-bypass-cve-2024-34323/#cve-details","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"ProPhoenix Law RMS v2022.2403.3.101 contains an access control flaw that allows unauthenticated users to access sensitive API endpoints, potentially leading to full system compromise. This vulnerability is particularly dangerous because it affects critical administrative functions without requiring any authentication.","exploitability":"The vulnerability is highly exploitable with no preconditions required since attackers can immediately access sensitive API endpoints without authentication, making it a straightforward path to unauthorized system access.","blast_radius":"If exploited, this flaw could allow attackers to gain full administrative access to the legal records management system, potentially exposing sensitive client data and enabling complete system takeover across all connected services.","remediation":"Upgrade to version 2022.2403.3.102 or later to address the access control issue in sensitive API endpoints.","detection":"Monitor for unauthorized access attempts to API endpoints that should require authentication, particularly looking for requests to protected administrative endpoints with no authentication tokens present in the logs.","tags":["access-control","api","authentication","web"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:46:48.722Z"}}