CVE-2024-34320

{
  "etk_id": "ETK-2026-2011",
  "cve_id": "CVE-2024-34320",
  "display_id": "CVE-2024-34320",
  "ghsa_id": "GHSA-679h-cxq5-8mcv",
  "euvd_id": "EUVD-2024-55797",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper access control in ProPhoenix Law RMS APIs",
  "summary": "ProPhoenix Law RMS version 2022.2403.3.101 has insufficient access controls on sensitive API endpoints. An unauthenticated remote attacker may be able to access those endpoints without the intended authorization checks when they are network reachable.",
  "mitigation": "Restrict access to the affected API endpoints to trusted networks and require authentication and authorization enforcement at a reverse proxy or API gateway. Contact the vendor for an updated release or remediation guidance before restoring broad network access.",
  "vendor": "ProPhoenix",
  "product": "ProPhoenix Law RMS",
  "affected": [
    {
      "affected_notes": [
        "n/a"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "n/a",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0035,
  "epss_percentile": 0.2729,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 9.3389119,
  "t0_at": "2026-10-13T00:00:00+00:00",
  "signals": {
    "check": {
      "at": "2026-10-18T20:47:31.603098+00:00",
      "days": 5.866337998819445,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T00:00:00+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-13T00:00:00+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T00:00:00+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-34320"
    }
  }
}