by Kastro
Paper/Archive/CVE-2024-6695

CVE-2024-6695

Unknown User Profile Builder — profile-builder <= 3.11.8 - Unauthenticated Privilege Escalation

EPSS 0.8%public exploitCVSS 9.8
critical.is priorityof 100
51
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 56.5.565 × 2011.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is due to improper logic flow on the user registration process.

Affected

ProductAffectedFixed inSource
User Profile Builder< 3.11.93.11.9CNA
profile_builder< 3.11.93.11.9CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/4afa5c85-ce27-4ca7-bba2-61fb39c53a5b