Lucene search

TwcertCVELIST:CVE-2024-5514

HistoryMay 30, 2024 - 2:14 a.m.

CVE-2024-5514 MinMax CMS - Hidden Functionality

2024-05-3002:14:46

CWE-798

CWE-912

twcert

www.cve.org

minmax cms

hidden functionality

fixed password

ip access control restrictions

system logs

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.3%

JSON

MinMax CMS from MinMax Digital Technology contains a hidden administrator account with a fixed password that cannot be removed or disabled from the management interface. Remote attackers who obtain this account can bypass IP access control restrictions and log in to the backend system without being recorded in the system logs.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "MinMax CMS",
    "vendor": "MinMax Digital Technology",
    "versions": [
      {
        "status": "affected",
        "version": "unknown"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-7828-c08b8-1.html

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.3%

JSON

Related for CVELIST:CVE-2024-5514