by Kastro
Paper/Archive/CVE-2024-24621

CVE-2024-24621

Softaculous Webuzo — Softaculous Webuzo Authentication Bypass

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 67.1.671 × 2013.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Softaculous Webuzo contains an authentication bypass vulnerability through the password reset functionality. Remote, anonymous attackers can exploit this vulnerability to gain full server access as the root user.

Affected

ProductAffectedFixed inSource
Webuzo3.2.1 – 4.2.9–CNA
webuzo3.2.1 – 4.2.9–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
XI (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupblog.exodusintel.com/2024/07/25/softaculous-webuzo-authentication-bypass