CVE-2024-50503

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

Published: Oct 30, 2024 / Updated: 20d ago

010
CVSS 9.8EPSS 0.04%Critical
CVE info copied to clipboard

Summary

Authentication Bypass Using an Alternate Path or Channel vulnerability in Deryck Oñate User Toolkit allows Authentication Bypass. This issue affects User Toolkit versions from n/a through 1.2.3.

Impact

This vulnerability has a high severity with a CVSS v3.1 base score of 9.8. It allows attackers to bypass authentication mechanisms, potentially gaining unauthorized access to the system with high impacts on confidentiality, integrity, and availability. Attackers can exploit this vulnerability remotely over the network without requiring any user interaction or privileges.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is not explicitly mentioned in the provided information. However, given that the vulnerability affects User Toolkit versions up to 1.2.3, it's likely that a patch or update may be available in a newer version, though this needs to be confirmed with the vendor.

Mitigation

While specific mitigation steps are not provided, general recommendations for authentication bypass vulnerabilities include: 1. Update User Toolkit to a version newer than 1.2.3 if available. 2. Implement strong access controls and multi-factor authentication. 3. Monitor and log authentication attempts to detect potential bypass attempts. 4. Consider implementing network segmentation to limit the exposure of affected systems. 5. Regularly audit and review authentication mechanisms for potential vulnerabilities.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-50503

Oct 30, 2024 at 8:15 AM
CVSS

A CVSS base score of 9.8 has been assigned.

Oct 30, 2024 at 8:15 AM / nvd
First Article

Feedly found the first article mentioning CVE-2024-50503. See article

Oct 30, 2024 at 8:17 AM / Vulners.com RSS Feed
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 30, 2024 at 8:18 AM
EPSS

EPSS Score was set to: 0.04% (Percentile: 9.9%)

Oct 31, 2024 at 10:14 AM
Static CVE Timeline Graph

Affected Systems

Jonathonkemp/wordpress_users
+null more

Links to Mitre Att&cks

T1083: File and Directory Discovery
+null more

Attack Patterns

CAPEC-127: Directory Indexing
+null more

News

US-CERT Vulnerability Summary for the Week of October 28, 2024
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High : vulnerabilities with a CVSS base score of 7.0–10.0 Medium : vulnerabilities with a CVSS base score of 4.0–6.9 Low : vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available.
Vulnerability Summary for the Week of October 28, 2024
High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source Info Patch Info acnoo -- flutter_api Authentication Bypass Using an Alternate Path or Channel vulnerability in Acnoo Acnoo Flutter API allows Authentication Bypass.This issue affects Acnoo Flutter API: from n/a through 1.0.5. 2024-10-28 9.8 CVE-2024-50486 audit@patchstack.com adirectory--aDirectory Unrestricted Upload of File with Dangerous Type vulnerability in adirectory aDirectory allows Upload a Web Shell to a Web Server.This issue affects aDirectory: from n/a through 1.3. 2024-10-29 10 CVE-2024-50420 audit@patchstack.com Ajar Productions--Ajar in5 Embed Unrestricted Upload of File with Dangerous Type vulnerability in Ajar Productions Ajar in5 Embed allows Upload a Web Shell to a Web Server.This issue affects Ajar in5 Embed: from n/a through 3.1.3. 2024-10-29 10 CVE-2024-50473 audit@patchstack.com Amin Omer--Sudan Payment Gateway for WooCommerce Unrestricted Upload of File with Dangerous Type vulnerability in Amin Omer Sudan Payment Gateway for WooCommerce allows Upload a Web Shell to a Web Server.This issue affects Sudan Payment Gateway for WooCommerce: from n/a through 1.2.2. 2024-10-29 10 CVE-2024-50494 audit@patchstack.com amu02aftab--Enable Shortcodes inside Widgets,Comments and Experts The The Enable Shortcodes inside Widgets,Comments and Experts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode.
NA - CVE-2024-50503 - Authentication Bypass Using an Alternate Path...
Authentication Bypass Using an Alternate Path or Channel vulnerability in Deryck Oñate User Toolkit allows Authentication Bypass.This issue affects User Toolkit: from n/a through 1.2.3.
CVE-2024-50503 | Deryck Oñate User Toolkit Plugin up to 1.2.3 on WordPress authentication bypass
A vulnerability, which was classified as critical , was found in Deryck Oñate User Toolkit Plugin up to 1.2.3 on WordPress. Affected is an unknown function. The manipulation leads to authentication bypass using alternate channel. This vulnerability is traded as CVE-2024-50503 . It is possible to launch the attack remotely. There is no exploit available.
CVE-2024-50503
Authentication Bypass Using an Alternate Path or Channel vulnerability in Deryck Oñate User Toolkit allows Authentication Bypass.This issue affects User Toolkit: from n/a through...
See 5 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI