PT-2025-2365 · Software Ag · Webmethods

Rasime Ekici · Published 2025-01-29 · Updated 2025-04-16 · CVE-2024-23733

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Software AG webMethods versions 10.15.0 before Core Fix7

Description The issue allows remote attackers to reach the administration panel and discover hostname and version information by sending an arbitrary username and a blank password to the "/WmAdmin/#/login/" API endpoint.

Recommendations For Software AG webMethods versions 10.15.0 before Core Fix7, consider disabling access to the "/WmAdmin/#/login/" API endpoint until a patch is available. Restrict the use of the username and password variables in this endpoint to minimize the risk of exploitation.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2024-23733

Affected Products

Webmethods

References · 7

• 🔥 https://github.com/ekcrsm/CVE-2024-23733/tree/main · Exploit
• 🔥 https://exploit-db.com/exploits/52237 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-23733 · Security Note
• https://twitter.com/CVEnew/status/1884717270074568818 · Twitter Post
• https://twitter.com/syedaquib77/status/1912602955934756886 · Twitter Post
• https://t.me/cvenotify/109561 · Telegram Post
• https://t.me/cvedetector/16728 · Telegram Post