PT-2024-33010 · Unknown · Lylme Spage

Gryffinbit · Published 2024-11-05 · Updated 2024-11-06 · CVE-2024-48176

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lylme Spage version 1.9.5

Description The issue is related to Incorrect Access Control, where there is no limit on the number of login attempts. Additionally, the verification code does not refresh after a failed login, allowing attackers to attempt multiple username and password combinations to gain access to the system backend.

Recommendations For Lylme Spage version 1.9.5, consider implementing a limit on the number of login attempts and ensure the verification code is refreshed after each failed login to prevent brute force attacks. As a temporary workaround, restrict access to the login functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-48176

Affected Products

Lylme Spage

References · 6

• https://osv.dev/vulnerability/CVE-2024-48176 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-48176 · Security Note
• https://gist.github.com/Gryffinbit/c0b37c6caae4844d4f59368e454d3e46 · Note
• https://twitter.com/CVEnew/status/1853943223720575133 · Twitter Post
• https://t.me/cvedetector/9963 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1854176128253976712 · Twitter Post