Lucene search

TwcertCVELIST:CVE-2024-2412

HistoryMar 13, 2024 - 2:31 a.m.

CVE-2024-2412 Heimavista Rpage and Epage - Broken Access Control

2024-03-1302:31:52

CWE-284

twcert

www.cve.org

cve-2024-2412

heimavista

rpage

epage

broken access control

remote attackers

user registration

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.7 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

The disabling function of the user registration page for Heimavista Rpage and Epage is not properly implemented, allowing remote attackers to complete user registration on sites where user registration is supposed to be disabled.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Rpage",
    "vendor": "Heimavista",
    "versions": [
      {
        "lessThanOrEqual": "v5.4.103.20231111",
        "status": "affected",
        "version": "earlier version",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Epage",
    "vendor": "Heimavista",
    "versions": [
      {
        "lessThanOrEqual": "v3.0.106.20231112",
        "status": "affected",
        "version": "earlier version",
        "versionType": "custom"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-7696-0951f-1.html

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.7 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

Related for CVELIST:CVE-2024-2412