PT-2025-24348 · Mops App+1 · Mops App+1

Published 2025-06-07 · Updated 2025-06-13 · CVE-2024-55585

Positive Technologies (AI Summary)

CVSS v4.0

9.0

Critical

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:N/RE:M/U:Red

Name of the Vulnerable Software and Affected Versions moPS App versions 1.8.618 and earlier moPS App Engine version 1.8.618

Description The issue allows all users to access administrative API endpoints, such as "/api/admin", without requiring additional authentication. This results in unrestricted read and write access. The problem is caused by incorrect access control.

Recommendations For moPS App versions 1.8.618 and earlier, update to a version that properly enforces access control to administrative API endpoints. For moPS App Engine version 1.8.618, restrict access to administrative API endpoints until a proper fix is applied.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2024-55585

Affected Products

Mops App

Mops App Engine

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-55585 · Security Note
• https://twitter.com/CveFindCom/status/1931428400276652491 · Twitter Post
• https://t.me/cvenotify/125002 · Telegram Post
• https://twitter.com/transilienceai/status/1931564824280089060 · Twitter Post
• https://mops.eu · Note
• https://twitter.com/Valko_CybrWolf/status/1931728689626239262 · Twitter Post
• https://t.me/cvetracker/25696 · Telegram Post
• https://t.me/cvenotify/125004 · Telegram Post
• https://twitter.com/CVEnew/status/1931429095033987328 · Twitter Post
• https://t.me/cvenotify/125593 · Telegram Post
• https://karatemuffin.it/data/2025_06_07_CVE-2024-55585_update.json · Note
• https://media.ccc.de/v/glt25-504-safety-ja-security-nein-analyse-eines-breit-eingesetzten-einsatzmanagmentsystems- · Note