CVE-2024-24621

The vulnerability results from improper condition verification (CWE-697) during the password reset process handling. This mechanism does not properly verify the requester's identity, which allows an anonymous attacker to bypass standard authentication. As a result, an attacker can reset the password in an unauthorized manner and take control of the system.

An attacker gains full access to the server with root user privileges, which means the possibility of taking complete control of the system, reading and modifying data, and installing arbitrary software.

Apply patches available from the vendor according to the references. Technical details of the vulnerability and recommendations were published by Exodus Intel on July 25, 2024 at: https://blog.exodusintel.com/2024/07/25/softaculous-webuzo-authentication-bypass/

Softaculous Webuzo — versions indicated in the vendor's references