CVEvulnerability
CVE-2024-28735
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2024-03-20
- Last modified
- 2026-07-09
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-287
Description
Unit4 Financials by Coda versions prior to 2023Q4 suffer from an incorrect access control authorization bypass vulnerability which allows an authenticated user to modify the password of any user of the application via a crafted request.
Affected configurations
• unit4 financials by coda (< 2023q4)
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://packetstormsecurity.com/files/177620/Financials-By-Coda-Authorization-Bypass.html Exploit, Third Party Advisory
- https://www.unit4.com/ Product
- https://www.unit4.com/products/financial-management-software Product
- https://packetstormsecurity.com/files/177620/Financials-By-Coda-Authorization-Bypass.html Exploit, Third Party Advisory
- https://www.unit4.com/ Product
- https://www.unit4.com/products/financial-management-software Product