CVE-2024-41517 is an Incorrect Access Control vulnerability identified in the Feripro software, version 2.2.3 and earlier. The vulnerability exists in the administrative interface endpoint "/admin/benutzer/institution/rechteverwaltung/uebersicht", which is responsible for managing user privileges within the system. Due to improper access control checks, remote attackers can access this endpoint without authentication, allowing them to retrieve a comprehensive list of all users and their corresponding privilege levels. This exposure of user privilege data can aid attackers in reconnaissance efforts, potentially facilitating further targeted attacks or privilege escalation attempts. The vulnerability is remotely exploitable over the network without requiring any user interaction or prior privileges, increasing its accessibility to attackers. The CVSS v3.1 base score is 5.3, reflecting a medium severity primarily due to the confidentiality impact, as integrity and availability remain unaffected. No patches or fixes are currently linked, and no known exploits have been reported in the wild as of the publication date. The vulnerability highlights a critical lapse in access control validation within Feripro's administrative modules, emphasizing the need for strict authentication and authorization enforcement on sensitive endpoints.

The primary impact of CVE-2024-41517 is the unauthorized disclosure of user and privilege information within affected Feripro installations. This information leakage can facilitate attacker reconnaissance, enabling them to identify high-privilege accounts and tailor subsequent attacks such as social engineering, credential stuffing, or privilege escalation. Although the vulnerability does not directly compromise system integrity or availability, the exposure of sensitive user privilege data undermines organizational security posture and increases the risk of more severe attacks. Organizations relying on Feripro for institutional or administrative management may face increased risk of targeted intrusions, especially if attackers combine this information with other vulnerabilities or weak credential policies. The lack of authentication requirements for exploitation broadens the attack surface, potentially allowing external threat actors to gather sensitive data without detection. While no active exploitation is currently known, the medium severity rating and ease of access make timely remediation important to prevent future attacks.

To mitigate CVE-2024-41517, organizations should immediately restrict access to the "/admin/benutzer/institution/rechteverwaltung/uebersicht" endpoint by implementing strong authentication and authorization controls, ensuring only authorized administrative users can access this resource. Network-level controls such as IP whitelisting or VPN requirements can further limit exposure. Monitoring and logging access to administrative endpoints should be enhanced to detect any unauthorized attempts. If patches or updates become available from Feripro, they should be applied promptly. In the absence of official patches, consider deploying web application firewalls (WAFs) with custom rules to block unauthorized requests targeting this endpoint. Conduct a thorough review of user privilege assignments and audit logs to detect any suspicious activity. Educate administrative users about the risks of privilege information disclosure and enforce strong credential policies to reduce the risk of subsequent attacks leveraging leaked data.