Read the docs
TI-2024-09697 Aliases CVE-2024-10469GHSA-59xx-g8cv-87qw

CERT/CC VINCE versions before 3.0.9 allows authenticated user to access User Management view.

Priority LOW 28CWE-276Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

VINCE versions before 3.0.9 is vulnerable to exposure of User information to authenticated users.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00183 7th percentileScored 2026-11-07
Fix Fixed VINCE (CERT/CC): 3.0.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CERT/CCVINCEbefore 3.0.93.0.9Patch availableCNA
  • VINCE VendorCERT/CC Affected before 3.0.9 Fixed in 3.0.9 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cert:vince:*:*:*:*:*:*:*:*before 3.0.9VulnerableCERT/CC
  • cpe:2.3:a:cert:vince:*:*:*:*:*:*:*:* Versions before 3.0.9 Vulnerable ·CERT/CC

Remediation

  • Fix · CNA VINCE (CERT/CC) Fixed in 3.0.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-10469
  2. 2026-10-03 Alias added: GHSA-59xx-g8cv-87qw

References

Other 1

  • TI-2022-19099 Deserialization of untrusted data in CERT/CC VINCE - The Vulnerability Information and… CVSS 3.1HIGH 8.8
  • TI-2022-09370 An open redirect vulnerability exists in CERT/CC VINCE software prior to version 1.50.0 CVSS 3.1MEDIUM 6.1
  • TI-2022-19104 An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4 CVSS 3.1MEDIUM 5.4
  • TI-2022-19102 An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4 CVSS 3.1MEDIUM 5.4
  • TI-2024-09236 Potential DoS Vulnerability in CERT VINCE Software Before Version 3.0.8 CVSS 3.1MEDIUM 4.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences