Lucene search

INCIBECVELIST:CVE-2024-6425

HistoryJul 01, 2024 - 12:56 p.m.

CVE-2024-6425 Incorrect Provision of Specified Functionality vulnerability in MESbook

2024-07-0112:56:20

CWE-684

INCIBE

www.cve.org

mesbook

incorrect provision

vulnerability

20221021.03

unauthenticated

remote attacker

user accounts

authentication

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

0.0004 Low

EPSS

Percentile

9.2%

JSON

Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can register user accounts without being authenticated from the route “/account/Register/” and in the parameters “UserName=<RANDOMUSER>&Password=<PASSWORD>&ConfirmPassword=<PASSWORD-REPEAT>”.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "MESbook",
    "vendor": "MESbook",
    "versions": [
      {
        "status": "affected",
        "version": "20221021.03"
      }
    ]
  }
]

References

www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-mesbook

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

0.0004 Low

EPSS

Percentile

9.2%

JSON

Related for CVELIST:CVE-2024-6425