CVE-2024-12056: Arcinfo Pcvue

Low severity, CVSS 2.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The Client secret is not checked when using the OAuth Password grant type. By exploiting this vulnerability, an attacker could connect to a web server using a client application not explicitly authorized as part of the OAuth deployment. Exploitation requires valid credentials and does not permit the attacker to bypass user privileges.

Affected products

• Arcinfo Pcvue: from 12.0, before 16.2.2 (fixed in 16.2.2)

Published 2024-12-04. Last modified 2026-06-17.