CVE-2024-48176
Last modified
CVE-2024-48176 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control. There is no limit on the number of login attempts, and the verification code will not be refreshed after a failed login, which allows attackers to blast the username and password and log into the system backend.. EPSS estimates a 0.45% chance of exploitation in the next 30 days.
Description
Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control. There is no limit on the number of login attempts, and the verification code will not be refreshed after a failed login, which allows attackers to blast the username and password and log into the system backend.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Lylme | Lylme Spage | 1.9.5 |
References
- https://gist.github.com/Gryffinbit/c0b37c6caae4844d4f59368e454d3e46Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-48176?
How severe is CVE-2024-48176?
How do I fix CVE-2024-48176?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-48150D-Link DIR-820L 1.05B03 has a stack overflow vulnerability i…9.8
- CVE-2024-48153DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicio…9.8
- CVE-2024-4816A vulnerability, which was classified as critical, was found…9.8
- CVE-2024-48168A stack overflow vulnerability exists in the sub_402280 func…9.8
- CVE-2024-4817A vulnerability has been found in Campcodes Online Laundry M…8.8
- CVE-2024-48170PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripti…5.4
- CVE-2024-48177MRCMS 3.1.2 contains a SQL injection vulnerability via the R…8.8
- CVE-2024-48178newbee-mall v1.0.0 is vulnerable to Server-Side Request Forg…8.1
- CVE-2024-4818A vulnerability was found in Campcodes Online Laundry Manage…5.3
- CVE-2024-48180ClassCMS <=4.8 is vulnerable to file inclusion in the nowVie…9.8
- CVE-2024-4819A vulnerability was found in Campcodes Online Laundry Manage…8.8
- CVE-2024-48191dingfanzu CMS 1.0 was discovered to contain a Cross-Site Req…6.3
Are you affected by CVE-2024-48176?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST