PT-2025-3393 · Wegia · Wegia

Natan Maia Morette · Published 2025-01-17 · Updated 2025-01-21 · CVE-2024-57032

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.2.0

Description The issue concerns an incorrect access control in the controle/control.php file. Specifically, the application fails to validate the value of the old password, allowing password changes by entering any value in the senha antiga field.

Recommendations For versions prior to 3.2.0, update to version 3.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the controle/control.php file or disabling password change functionality until a patch is applied. Avoid using the senha antiga field in the affected API endpoint until the issue is resolved.

Exploit

Fix

Improper Access Control

Incorrect Default Permissions

Incorrect Authorization

Weakness Enumeration

CWE-284

CWE-276

CWE-863

Related Identifiers

CVE-2024-57032

Affected Products

Wegia

References · 7

• 🔥 https://github.com/nmmorette/vulnerability-research/blob/main/CVE-2024-57032 · Exploit
• https://osv.dev/vulnerability/CVE-2024-57032 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-57032 · Security Note
• https://twitter.com/VulmonFeeds/status/1880422262278394106 · Twitter Post
• https://t.me/cvedetector/15736 · Telegram Post
• https://twitter.com/CVEnew/status/1880384741947453549 · Twitter Post
• https://wegia.org · Note