CVEvulnerability

CVE-2024-22179

8.7 HIGH Published 2024-04-18 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2024-04-18
Last modified
2026-06-17
Assigner
[email protected]
CVSS 4.0 ([email protected])
8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-302

Description

The application is vulnerable to an unauthenticated parameter manipulation that allows an attacker to set the credentials to blank giving her access to the admin panel. Also vulnerable to account takeover and arbitrary password change.

Related

Weakness · CWE (1)

  • CWE-302 Authentication Bypass by Assumed-Immutable Data weakness

References