PT-2025-18205 · Modernwms · Modernwms

Published 2025-04-29 · Updated 2025-04-29 · CVE-2024-57698

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions modernwms version 1.0

Description The issue allows an attacker to view the MD5 hash of the administrator password and other attributes without authentication. This is due to excessive exposure of information and the lack of adequate access control on the "/user/list?culture=en-us" endpoint.

Recommendations For modernwms version 1.0, consider restricting access to the "/user/list?culture=en-us" endpoint until a patch is available. As a temporary workaround, limit the exposure of sensitive information by implementing proper access controls to prevent unauthorized access.

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2024-57698

Affected Products

Modernwms

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-57698 · Security Note
• https://osv.dev/vulnerability/CVE-2024-57698 · Vendor Advisory
• https://t.me/cvetracker/22652 · Telegram Post
• https://t.me/cvedetector/24048 · Telegram Post
• https://twitter.com/CVEnew/status/1917316900138139748 · Twitter Post
• https://github.com/rodolfomarianocy/xpl-ModernWMS · Note