Lucene search

XICVE-2024-24621

HistoryJul 25, 2024 - 10:15 p.m.

CVE-2024-24621

2024-07-2522:15:05

CWE-697

web.nvd.nist.gov

softaculous webuzo

authentication bypass

vulnerability

cve-2024-24621

password reset

remote attackers

full server access

root user

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.001

Percentile

39.5%

JSON

Softaculous Webuzo contains an authentication bypass vulnerability through the password reset functionality. Remote, anonymous attackers can exploit this vulnerability to gain full server access as the root user.

Affected configurations

Nvd

Node

softaculouswebuzoRange<4.2.9

VendorProductVersionCPE
softaculouswebuzo*cpe:2.3:a:softaculous:webuzo:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
softaculous	webuzo	*	cpe:2.3:a:softaculous:webuzo::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Webuzo",
    "vendor": "Softaculous",
    "versions": [
      {
        "lessThanOrEqual": "4.2.9",
        "status": "affected",
        "version": "3.2.1",
        "versionType": "semver"
      }
    ]
  }
]

References

blog.exodusintel.com/2024/07/25/softaculous-webuzo-authentication-bypass/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.001

Percentile

39.5%

JSON

Related for CVE-2024-24621