PT-2024-17616 · Dromara · Dromara Ujcms

Vastzero · Published 2024-12-11 · Updated 2024-12-13 · CVE-2024-12483

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dromara UJCMS versions up to 9.6.3

Description A problematic vulnerability has been found in Dromara UJCMS, affecting an unknown part of the file /users/id of the component User ID Handler. The manipulation leads to authorization bypass. It is possible to initiate the attack remotely. The complexity of an attack is rather high, and the exploitability is told to be difficult.

Recommendations For versions up to 9.6.3, as a temporary workaround, consider restricting access to the /users/id endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authorization

IDOR

Weakness Enumeration

CWE-285

CWE-639

Related Identifiers

CVE-2024-12483

Affected Products

Dromara Ujcms

References · 10

• 🔥 https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/IDOR-UsernameEnumeration.md · Exploit
• 🔥 https://exploit-db.com/exploits/52264 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-12483 · Security Note
• https://osv.dev/vulnerability/CVE-2024-12483 · Vendor Advisory
• https://vuldb.com/?submit.458895 · Note
• https://twitter.com/CVEnew/status/1867537668080271695 · Twitter Post
• https://vuldb.com/?id.287865 · Note
• https://twitter.com/VulmonFeeds/status/1867040237551022234 · Twitter Post
• https://vuldb.com/?ctiid.287865 · Note
• https://t.me/cvedetector/12656 · Telegram Post