HIGH🇬🇧 English

CVE-2024-47652

CVSS 7.6v4.0pub. 2024-10-04upd. 2024-10-16

This vulnerability exists in Shilpi Client Dashboard due to implementation of inadequate authentication mechanism in the login module wherein access to any users account is granted with just their corresponding mobile number. A remote attacker could exploit this vulnerability by providing mobile number of targeted user, to obtain complete access to the targeted user account.

oryginał EN
CVSS Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Shilpisoft Client Dashboard

    APP
    Shilpisoft
    < 9.7.0
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2024-47656CRITICAL9.3PL ✓ten sam produkt

Brak ograniczeń prób logowania w Shilpi Client Dashboard (brute force)

CVE-2024-47653HIGH7.1ten sam produkt

This vulnerability exists in Shilpi Client Dashboard due to lack of authorization for modification and cancell...

CVE-2024-47654HIGH7.1ten sam produkt

This vulnerability exists in Shilpi Client Dashboard due to lack of rate limiting and Captcha protection for O...

CVE-2024-47655HIGH8.6ten sam produkt

This vulnerability exists in the Shilpi Client Dashboard due to improper validation of files being uploaded ot...

CVE-2024-47657HIGH7.1ten sam vendor

This vulnerability exists in the Shilpi Net Back Office due to improper access controls on certain API endpoin...