CVE-2024-4428 is a Critical (CVSS 9.8) missing authentication and authorization flaw in the Menulux Information Technologies Management Portal, through version 21.05.2024. The record says it lets an outsider collect data as users provided it. It names no fixed release, so ask the vendor.
What's affected
- Product: Menulux Information Technologies Management Portal (the record spells it Managment Portal), versions through 21.05.2024.
- Fixed version: none in the record. The Turkish national advisory TR-24-1356 is listed, and it did not load when I tried it.
- Severity: Critical, CVSS 9.8, no privileges and no interaction.
- Weaknesses: missing authentication for a critical function and missing authorization.
- Exploitation: KEV is false.
How to check if you're exposed
Find out whether your organization runs the Menulux portal and which build date it carries. The version string looks like a date, so a build on or before 21.05.2024 matches the record.
Because the flaw is missing login checks, review access logs for requests to portal functions from addresses that never logged in. Check what the portal stores, because the record describes data collection.
What to do now
- Confirm whether the portal is in use, and which build.
- Put it behind a VPN or an IP allow list until the vendor confirms a fix.
- Review logs for unauthenticated requests to portal functions.
- Contact Menulux for a fixed build and request written confirmation.
- Read advisory TR-24-1356 for the national agency's wording.
Why it matters
The record maps this to CWE-306, CWE-862 and CWE-862. They describe a critical function that requires no login and, in addition, no check on who is allowed to use it. Missing authentication means anyone can call it. Missing authorization means even a logged in user is not checked.
When both are absent, the portal's functions are available to anyone who can reach it. The record's version is a date, so ask the vendor how to tell a patched build from an unpatched one, and keep the answer with your records. Placing it behind network controls is the only quick defense.
Quick check
Is a fixed version known?
The record names none. Contact the vendor and check the Turkish national advisory.
Does an attacker need an account?
No. The vector shows no privileges required.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4428 (published 2024-08-29) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
