How severe is CVE-2024-28345?

CVE-2024-28345 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity low, and availability low.

Is CVE-2024-28345 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-28345?

CVE-2024-28345 affects Sipwise Next Generation Communication Platform. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-28345?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-28345 have an EU (EUVD) identifier?

Yes. CVE-2024-28345 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-25443.

When was CVE-2024-28345 published?

CVE-2024-28345 was published on 2024-04-10 and last updated on 2026-06-17.

CVE-2024-28345

CVE-2024-28345 is a medium-severity vulnerability in Sipwise Next Generation Communication Platform with a CVSS 3.x base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 5.5)
EPSS exploit prediction: 0% (34th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-25443
Affected product: Sipwise Next Generation Communication Platform
Published: 2024-04-10
Last modified: 2026-06-17

Description

An issue discovered in Sipwise C5 NGCP Dashboard below mr11.5.1 allows a low privileged user to access the Journal endpoint by directly visit the URL.

Frequently asked questions

What is CVE-2024-28345?: An issue discovered in Sipwise C5 NGCP Dashboard below mr11.5.1 allows a low privileged user to access the Journal endpoint by directly visit the URL.
How severe is CVE-2024-28345?: CVE-2024-28345 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity low, and availability low.
Is CVE-2024-28345 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-28345?: CVE-2024-28345 affects Sipwise Next Generation Communication Platform. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-28345?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-28345 have an EU (EUVD) identifier?: Yes. CVE-2024-28345 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-25443.
When was CVE-2024-28345 published?: CVE-2024-28345 was published on 2024-04-10 and last updated on 2026-06-17.

References

https://securitycafe.ro/2024/03/21/cve-2024-28344-cve-2024-28345-in-sipwise-c5/

Affected products (1)

cpe:2.3:a:sipwise:next_generation_communication_platform:*:*:*:*:-:*:*:*

More vulnerabilities in Sipwise Next Generation Communication Platform

CVE-2021-31584 — High (CVSS 8.8): Sipwise C5 NGCP www_csc version 3.6.4 up to and including platform NGCP CE mr3.8.13 allows call/click2dial CSRF attacks…
CVE-2021-31583 — Medium (CVSS 5.4): Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 has multiple authenticated…
CVE-2024-28344 — Low (CVSS 3.1): An Open Redirect vulnerability was found in Sipwise C5 NGCP Dashboard below mr11.5.1. The Open Redirect vulnerability…

All CVEs affecting Sipwise Next Generation Communication Platform →