CVE-2024-2317 is a low severity improper authorization in Bdtask Hospital AutoManager up to 20240227, scored 3.8 by NVD. The record lists no fixed release, so there is no confirmed patch to install. Restrict access to the affected component, correct the code if you own it, or retire the software.
Weakness: CWE-285 (Improper Authorization).
What's affected
- Affected: Bdtask Hospital AutoManager, up to 20240227, as listed in the NVD record.
- Fixed: none named. The record names no fixed release for Bdtask Hospital AutoManager. Treat the software as unpatched until the vendor or the project says otherwise.
- Attack conditions: the CVSS vector is
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L, which means network reachable, administrator-level privileges needed, and the attack needs no user interaction.
The record says the flaw sits in the file /prescription/prescription/delete/ of the Prescription Page component. The vendor was contacted early about this disclosure but did not respond in any way, according to the record. The record also says the exploit has been disclosed to the public, which is why the exposure window matters whatever the score.
How to check if you're exposed
This is a standalone application, not a package on a registry, so there is no package manager command that reports it. Work through these steps instead.
- Search your hosting inventory, source repositories and deployment folders for the project name (Bdtask Hospital AutoManager).
- Open the installed copy and confirm whether it is version up to 20240227. If the version is not recorded, assume it is affected.
- Check whether /prescription/prescription/delete/ can be reached from outside your network and who can authenticate to it.
- Review web server access logs for unexpected requests to that path, and keep the logs you find.
If you track dependencies, the free in-browser dependency scan can show whether a library or package in your project matches a known CVE. It will not find a standalone PHP application or a firmware image that was never packaged as a dependency, so keep your own inventory of those.
What to do now
- Find every deployment of Bdtask Hospital AutoManager and decide whether it needs to be online at all. Many of these projects are tutorial or demo code.
- Look for a vendor or upstream update. The record names none, so check the project repository and the VulDB entry linked in the sources.
- Put the application behind authentication and a network allow list, or take it offline, until a fix exists.
- If you own the code, check that the signed in user is allowed to delete the specific record before acting on the request.
- Record the exception in your risk register with an owner and a review date.
Why it matters
Improper authorization is different from missing login. The user is signed in, but the application does not check whether this user may act on this record. A delete action should confirm ownership or role every time it runs.
The record classes this as CWE-285 (Improper Authorization). NVD scored it 3.8 (Low) with CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L. The KEV flag in the record is false, so CISA's Known Exploited Vulnerabilities catalog does not list it, though the record notes public disclosure of the exploit. Small open source and sample style applications like this one often never get patched, so the control you have is exposure, not a version bump.
Quick check
Is there a patch for CVE-2024-2317?
The record lists no fixed version for Bdtask Hospital AutoManager. Check the project repository and the VulDB entry before assuming one exists, and plan around restricting access in the meantime.
Is this being exploited in the wild?
The record's KEV flag is false and no advisory we reviewed reports exploitation. The record does say the exploit details were published, so a copy of the technique is available to anyone.
Sources
- CVE-2024-2317 record on Safeguard Gold
- NVD description and CVSS vector for CVE-2024-2317, as held in the batch record
- VulDB entry for this CVE, linked from the record (see the Gold page for the reference list)
Last reviewed: 19 October 2026.
