---
title: "CVE-2024-50617: CVE Public Notification of Resolution | CIPPlanner"
description: "CIPPlanner public notification of resolution for CVE-2024-50617 in CIPAce. Status: Remedied."
image: https://www.cipplanner.com/hubfs/raw_assets/public/cipplanner-theme/images/og-default.png
---

[![CIPPlanner](https://www.cipplanner.com/hs-fs/hubfs/raw_assets/public/cipplanner-theme/images/cipplanner-logo.png?width=180&height=36&name=cipplanner-logo.png)](https://www.cipplanner.com/home?hsLang=en)

- Platform
- Solutions
- Who We Serve
- Customers
- [Contact](https://www.cipplanner.com/contact?hsLang=en)

[Request a Demo](https://www.cipplanner.com/request-a-demo?hsLang=en)

#### The Platform

- [CIPAce Platform Overview](https://www.cipplanner.com/platform?hsLang=en)
- [AI Core](https://www.cipplanner.com/platform/ai-core?hsLang=en)
- [Integrations and APIs](https://www.cipplanner.com/platform/integrations?hsLang=en)
- [Security and Compliance](https://www.cipplanner.com/platform/security-and-compliance?hsLang=en)

Platform

One metadata-driven, low-code platform underneath every solution, so adding a solution is a configuration, not a second system of record.

[Explore the CIPAce platform ›](https://www.cipplanner.com/platform?hsLang=en)

#### Plan and Deliver

- [Capital Planning and Budgeting](https://www.cipplanner.com/solutions/capital-planning-and-budgeting?hsLang=en)
- [Capital Program Lifecycle Management](https://www.cipplanner.com/solutions/capital-program-lifecycle-management?hsLang=en)
- [Project Schedule and Resource Management](https://www.cipplanner.com/solutions/project-schedule-and-resource-management?hsLang=en)

#### Operate and Maintain

- [Enterprise Asset Management](https://www.cipplanner.com/solutions/enterprise-asset-management?hsLang=en)
- [Inspection and Work Management](https://www.cipplanner.com/solutions/inspection-and-work-management?hsLang=en)
- [Bridge Inspection and Asset Management](https://www.cipplanner.com/solutions/bridge-inspection-and-asset-management?hsLang=en)

Lifecycle

Condition data from operations feeds the next capital plan. Start where the pressure is and add the rest without a second implementation.

[Talk to us about your program ›](https://www.cipplanner.com/request-a-demo?hsLang=en)

#### Sectors

- [Cities and Counties](https://www.cipplanner.com/who-we-serve/cities-and-counties?hsLang=en)
- [Transportation and Aviation](https://www.cipplanner.com/who-we-serve/transportation?hsLang=en)
- [Water and Utilities](https://www.cipplanner.com/who-we-serve/water-and-utilities?hsLang=en)
- [Private Enterprise](https://www.cipplanner.com/who-we-serve/private-enterprise?hsLang=en)

Qualification

Every sector page carries the funding sources, reporting obligations, and approval chain that shape a capital program in that sector. Named agencies and their results are in Customers.

[See customer results ›](https://www.cipplanner.com/customers?hsLang=en)

#### Customer Stories

- [Fairfax County, Virginia](https://www.cipplanner.com/customers/fairfax-county?hsLang=en)
- [New York City Department of Transportation](https://www.cipplanner.com/customers/nycdot?hsLang=en)
- [City of Baltimore](https://www.cipplanner.com/customers/city-of-baltimore?hsLang=en)
- [San Antonio Water System](https://www.cipplanner.com/customers/saws?hsLang=en)
- [Indianapolis Airport Authority](https://www.cipplanner.com/customers/iaa?hsLang=en)
- [Veolia Water](https://www.cipplanner.com/customers/veolia?hsLang=en)

#### More From Customers

- [All Customer Stories](https://www.cipplanner.com/customers?hsLang=en)
- [Case Studies on Request](https://www.cipplanner.com/customers#on-request)
- [Ask for a Peer Reference](https://www.cipplanner.com/contact#form)

Proof

More than 250 billion dollars in capital projects and programs managed on CIPAce, across 24 U.S. states.

[View all customer stories ›](https://www.cipplanner.com/customers?hsLang=en)

[Platform](https://www.cipplanner.com/platform?hsLang=en) › [Security and Compliance](https://www.cipplanner.com/platform/security-and-compliance?hsLang=en) ›

CVE-2024-50617

Security Advisory · CVE Public Notification of Resolution

# CVE-2024-50617: CVE Public Notification of Resolution

Status: Remedied. Incorrect access control in the File Download and Get File handler components, before version 9.17.

At CIPPlanner, the security of customer installations of CIPAce™ software and data is our top priority. Therefore, we would like to inform you that CIPPlanner has recently identified a security incident and taken measures to remedy the situation; an enterprise-wide resolution initiative, identified and tracked as “S10001”, in March 2025.

By: Kenneth Price  
Published: December 24, 2025, 9:19 AM EST  
Last Modified: December 24, 2025, 9:19 AM EST

## Situational Summary

The incident involved an unauthorized party compromising an inactive third-party vendor user account at one of our customers. An independent investigation concluded by both the CIPPlanner cybersecurity team and the client’s IT team found no evidence of significant operational impact or security breach. We attribute this desired outcome to: CIPPlanner’s established security protocols; implementation of daily operational best practices; CIPAce™ maintenance; and the diligence of our SuperAdmin users.

In according with the “CIPPlanner Security Incident Response Operating Procedure”, the cybersecurity team identified and remedied the Common Vulnerability and Exposures (CVE) discussed below.

## Vulnerability Details

Vulnerabilities in File Download and Get File handler components in CIPAce™ product of CIPPlanner Corporation before version 9.17 allows attackers to download unauthorized files. An authenticated user can easily change the file ID parameter in or pass the physical file path in the URL query string to download the files which are not expected without correct data access configured for documents.

## CVE Registration

In 2024, CIPPlanner reported to U.S. Government funded MITRE four (4) information security vulnerabilities to MITRE; the latter identifying the vulnerability as CVE-2024-50617. Registration metadata are as follows:

| Type | Incorrect Access Control |
| --- | --- |
| CVSS Version | 4.0 |
| Metric Score | 5.3 |
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/SC:N/VI:N/SI:N/VA:N/SA:N/ |

## CVE Resolution

The status of CIPPlanner resolution of CVE-2024-50617 is “Remedied”. Related activities are:

- CIPPlanner developed and distributed software patches to its valued customers. These resolutions are now embedded in later versions of the CIPAce™ codebase.
- CIPPlanner retained New Jersey based cybersecurity consultant, Entersoft US LLC, to execute independent SAST, DAST, and Penetration Testing services on CIPAce™ full stack. Entersoft has performed independent services and certified CIPAce™ software. The certification protocols required CIPPlanner to remedy security vulnerabilities that are now reflected in later version codebases.
- Resolution of the CVE came in the form of tokenization of the file ID and path in the file download URL on the server side ensures that tampering with the file ID or path parameter values in the URL will not pass server-side validation and the download will not be executed.

Subsequently, CIPPlanner’s Product and Implementation teams executed the above software resolutions by:

- Merging needed software remedies in new versions of CIPAce™ v10.x and beyond.
- Distributing software patches and instructions to customers where no CIPAce™ upgrade is underway.
- Code-merging software remedies into CIPAce™ as a part of ongoing software upgrade projects.

If you have any questions or concerns, please do not hesitate to contact us.

## Footnote

The mission of the CVE Program is to identify, define, and catalog publicly disclosed cybersecurity vulnerabilities. The CVE program is maintained by the National Cybersecurity FFRDC (Federal Funded Research and Development Center), which is funded by the US Department of Homeland Security. For more information, please visit:

- CVE Program Mission – [CVE Website](https://www.cve.org/)
- CVE terminology – [Glossary | CVE](https://www.cve.org/ResourcesSupport/Glossary)
- MITRE CVE Request form – [CVE – Common Vulnerabilities and Exposures (CVE)](https://cveform.mitre.org/)
- CVSS – [Common Vulnerability Scoring System Version 4.0](https://www.first.org/cvss/v4-0/)

## Report a Security Concern

The official record for this vulnerability is [CVE-2024-50617 at cve.org](https://www.cve.org/CVERecord?id=CVE-2024-50617).

To report a suspected vulnerability or security event in CIPAce™, email [EventReport@cipplanner.com](mailto:EventReport@cipplanner.com). Our vulnerability management and disclosure practice is described on the [Security and Compliance](https://www.cipplanner.com/platform/security-and-compliance#advisories) page.

![CIPPlanner](https://www.cipplanner.com/hs-fs/hubfs/raw_assets/public/cipplanner-theme/images/cipplanner-logo-white.png?width=217&height=30&name=cipplanner-logo-white.png)

For more than 25 years, CIPPlanner has delivered enterprise capital program management solutions to public sector infrastructure owners. CIPAce™ serves as the system of record for billion-dollar programs across city, county, state, utility, and transportation agencies in 24 U.S. states.

[Request a Demo](https://www.cipplanner.com/request-a-demo?hsLang=en)

#### Platform

[CIPAce Platform Overview](https://www.cipplanner.com/platform?hsLang=en) [AI Core](https://www.cipplanner.com/platform/ai-core?hsLang=en) [Integrations and APIs](https://www.cipplanner.com/platform/integrations?hsLang=en) [Security and Compliance](https://www.cipplanner.com/platform/security-and-compliance?hsLang=en)

#### Solutions

[Capital Planning and Budgeting](https://www.cipplanner.com/solutions/capital-planning-and-budgeting?hsLang=en) [Capital Program Lifecycle Management](https://www.cipplanner.com/solutions/capital-program-lifecycle-management?hsLang=en) [Project Schedule and Resource Management](https://www.cipplanner.com/solutions/project-schedule-and-resource-management?hsLang=en) [Enterprise Asset Management](https://www.cipplanner.com/solutions/enterprise-asset-management?hsLang=en) [Inspection and Work Management](https://www.cipplanner.com/solutions/inspection-and-work-management?hsLang=en) [Bridge Inspection and Asset Management](https://www.cipplanner.com/solutions/bridge-inspection-and-asset-management?hsLang=en)

#### Who We Serve

[Cities and Counties](https://www.cipplanner.com/who-we-serve/cities-and-counties?hsLang=en) [Transportation and Aviation](https://www.cipplanner.com/who-we-serve/transportation?hsLang=en) [Water and Utilities](https://www.cipplanner.com/who-we-serve/water-and-utilities?hsLang=en) [Private Enterprise](https://www.cipplanner.com/who-we-serve/private-enterprise?hsLang=en)

#### Customers

[All Customer Stories](https://www.cipplanner.com/customers?hsLang=en) [Fairfax County, Virginia](https://www.cipplanner.com/customers/fairfax-county?hsLang=en) [New York City Department of Transportation](https://www.cipplanner.com/customers/nycdot?hsLang=en) [City of Baltimore](https://www.cipplanner.com/customers/city-of-baltimore?hsLang=en) [San Antonio Water System](https://www.cipplanner.com/customers/saws?hsLang=en) [Indianapolis Airport Authority](https://www.cipplanner.com/customers/iaa?hsLang=en) [Veolia Water](https://www.cipplanner.com/customers/veolia?hsLang=en) [Case Studies on Request](https://www.cipplanner.com/customers#on-request)

#### Company

[Request a Demo](https://www.cipplanner.com/request-a-demo?hsLang=en) [Contact](https://www.cipplanner.com/contact?hsLang=en)

© 2026 CIPPlanner Corporation. All rights reserved.

[Privacy Policy](https://www.cipplanner.com/contact#privacy)[Cookie Policy](https://www.cipplanner.com/contact#cookies) [Security and Compliance](https://www.cipplanner.com/platform/security-and-compliance?hsLang=en)

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://www.cipplanner.com/#organization",
  "@type" : "Organization",
  "brand" : {
    "@type" : "Brand",
    "name" : "CIPAce"
  },
  "description" : "For more than 25 years, CIPPlanner has delivered enterprise capital program management solutions to public sector infrastructure owners. CIPAce serves as the system of record for billion-dollar programs across city, county, state, utility, and transportation agencies in 24 U.S. states.",
  "name" : "CIPPlanner Corporation",
  "url" : "https://www.cipplanner.com"
}
```

```json
{
  "@context" : "https://schema.org",
  "@type" : "BreadcrumbList",
  "itemListElement" : [ {
    "@type" : "ListItem",
    "item" : "https://www.cipplanner.com/",
    "name" : "Home",
    "position" : 1
  }, {
    "@type" : "ListItem",
    "item" : "https://www.cipplanner.com/platform",
    "name" : "Platform",
    "position" : 2
  }, {
    "@type" : "ListItem",
    "item" : "https://www.cipplanner.com/platform/security-and-compliance",
    "name" : "Security and Compliance",
    "position" : 3
  }, {
    "@type" : "ListItem",
    "item" : "https://www.cipplanner.com/cve-2024-50617-cve-public-notification-of-resolution",
    "name" : "CVE-2024-50617",
    "position" : 4
  } ]
}
```