CVE-2024-3777

Improper Access Control (CWE-284)

Published: Apr 15, 2024 / Updated: 7mo ago

cveNotify : 🚨 CVE-2024-3777The password reset feature of Ai3 QbiBot lacks proper access control, allowing unauthenticated remote attackers to reset any user's password.🎖@cveNotify

The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High : vulnerabilities with a CVSS base score of 7.0–10.0 Medium : vulnerabilities with a CVSS base score of 4.0–6.9 Low : vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA.

Vulnerability Summary for the Week of April 15, 2024 bjackson Apr 22, 2024 High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info 10web -- slider_by_10web Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Slider by 10Web allows Reflected XSS.This issue affects Slider by 10Web: from n/a through 1.2.54. 2024-04-18 7.1 CVE-2024-32578 audit@patchstack.com adam_bowen -- tax_rate_upload Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adam Bowen Tax Rate Upload allows Reflected XSS.This issue affects Tax Rate Upload: from n/a through 2.4.5. 2024-04-17 7.1 CVE-2024-32546 audit@patchstack.com ai3_ -- qbibot_ The password reset feature of Ai3 QbiBot lacks proper access control, allowing unauthenticated remote attackers to reset any user's password. 2024-04-15 9.8 CVE-2024-3777 twcert@cert.org.tw ai3_ -- qbibot_ The file upload functionality of Ai3 QbiBot does not properly restrict types of uploaded files, allowing remote attackers with administrator privilege to upload files with dangerous type containing malicious code. 2024-04-15 7.2 CVE-2024-3778 twcert@cert.org.tw aitthemes -- citadela_listing Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AitThemes Citadela Listing.This issue affects Citadela Listing: from n/a through 5.18.1. 2024-04-16 7.5 CVE-2024-32086 audit@patchstack.com akana -- community_manager_developer_portal A server-side request forgery (SSRF) was discovered in the Akana Community Manager Developer Portal in versions prior to and including 2022.1.3. Reported by Jakob Antonsson.

A CVSS base score of 9.8 has been assigned. EPSS Score was set to: 0% (Percentile: 8%)

Critical Severity Description The password reset feature of Ai3 QbiBot lacks proper access control, allowing unauthenticated remote attackers to reset any user's password. Read more at https://www.tenable.com/cve/CVE-2024-3777