CVE-2024-45877

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-45877
baltic-it TOPqw Webportal v1.35.283.2 is vulnerable to Incorrect Access Control in the User Management function in /Apps/TOPqw/BenutzerManagement.aspx. This allows a low privileged user to access all modules in the web portal, view and manipulate information and permissions of other users, lock other user or unlock the own account, change the password of other users, create new users or delete existing users and view, manipulate and delete reference data.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cyber.wtf/2024/11/11/topqw-webportal-cves/
Configurations

No configuration.

History

26 Nov 2024, 20:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
CWE CWE-863

15 Nov 2024, 14:00

Type Values Removed Values Added
Summary
  • (es) El portal web TOPqw v1.35.283.2 de baltic-it es vulnerable a un control de acceso incorrecto en la función de administración de usuarios en /Apps/TOPqw/BenutzerManagement.aspx. Esto permite que un usuario con pocos privilegios acceda a todos los módulos del portal web, vea y manipule información y permisos de otros usuarios, bloquee a otros usuarios o desbloquee su propia cuenta, cambie la contraseña de otros usuarios, cree nuevos usuarios o elimine usuarios existentes y vea, manipule y elimine datos de referencia.

13 Nov 2024, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-13 21:15

Updated : 2024-11-26 20:15

NVD link : CVE-2024-45877

Mitre link : CVE-2024-45877

CVE.ORG link : CVE-2024-45877

JSON object : View

Products Affected

No product.

CWE
CWE-863

Incorrect Authorization