PT-2024-15827 · Softwarex · Softwarex

Published 2024-03-02 · Updated 2025-01-21 · CVE-2024-0795

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

The affected software is related to a specific application or system that uses admin or manager roles. If an attacker gains access to an instance with the admin or manager role, they can create a new user with an admin role without any backend authentication to prevent it, allowing them to use the new account to gain elevated privileges on the instance. An exploit is available, which enables attackers to bypass backend authentication and escalate privileges. More information about the issue can be found at https://t.co/MlDvjfDMxj and https://t.co/zwHifLKZSu. #AdminRole #ElevatedPrivileges #BackendAuthentication #InstanceAccess #PrivilegeEscalation #SecurityRisk #ExploitAvailable #AuthenticationBypass

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-0795

Affected Products

Softwarex

References · 7

• 🔥 https://huntr.com/bounties/f69e3307-7b44-4776-ac60-2990990723ec · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/9a237db3d1f66cdbcf5079599258f5fb251c5564 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-0795 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0795 · Vendor Advisory
• https://twitter.com/CVEnew/status/1764038875264192554 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1764070885156130983 · Twitter Post
• https://t.me/cvenotify/108011 · Telegram Post