Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2024-9305

Summary
Assigner-Wordfence
Assigner Org ID-b15e7b5b-3da4-40ae-a43c-f7aa60e62599
Published At-16 Oct, 2024 | 02:05
Updated At-16 Oct, 2024 | 13:35
Rejected At-
Credits

AppPresser – Mobile App Framework <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTP

The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.4. This is due to the appp_reset_password() and validate_reset_password() functions not having enough controls to prevent a successful brute force attack of the OTP to change a password, or verify that a password reset request came from an authorized user. This makes it possible for unauthenticated attackers to generate and brute force an OTP that makes it possible to change any users passwords, including an administrator.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:Wordfence
Assigner Org ID:b15e7b5b-3da4-40ae-a43c-f7aa60e62599
Published At:16 Oct, 2024 | 02:05
Updated At:16 Oct, 2024 | 13:35
Rejected At:
▼CVE Numbering Authority (CNA)
AppPresser – Mobile App Framework <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTP

The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.4. This is due to the appp_reset_password() and validate_reset_password() functions not having enough controls to prevent a successful brute force attack of the OTP to change a password, or verify that a password reset request came from an authorized user. This makes it possible for unauthenticated attackers to generate and brute force an OTP that makes it possible to change any users passwords, including an administrator.

Affected Products
Vendor
scottopolis
Product
AppPresser – Mobile App Framework
Default Status
unaffected
Versions
Affected
  • From * through 4.4.4 (semver)
Problem Types
TypeCWE IDDescription
CWECWE-640CWE-640 Weak Password Recovery Mechanism for Forgotten Password
Type: CWE
CWE ID: CWE-640
Description: CWE-640 Weak Password Recovery Mechanism for Forgotten Password
Metrics
VersionBase scoreBase severityVector
3.18.1HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Version: 3.1
Base score: 8.1
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
finder
wesley
Timeline
EventDate
Disclosed2024-10-15 00:00:00
Event: Disclosed
Date: 2024-10-15 00:00:00
Replaced By
Rejected Reason
References
HyperlinkResource
https://www.wordfence.com/threat-intel/vulnerabilities/id/45647fa6-a98d-4eb4-a287-f523e434688b?source=cve
N/A
https://plugins.trac.wordpress.org/browser/apppresser/tags/4.4.4/inc/AppPresser_Ajax_Extras.php#L31
N/A
https://plugins.trac.wordpress.org/browser/apppresser/tags/4.4.4/inc/AppPresser_WPAPI_Mods.php#L92
N/A
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3168744%40apppresser&new=3168744%40apppresser&sfp_email=&sfph_mail=
N/A
Hyperlink: https://www.wordfence.com/threat-intel/vulnerabilities/id/45647fa6-a98d-4eb4-a287-f523e434688b?source=cve
Resource: N/A
Hyperlink: https://plugins.trac.wordpress.org/browser/apppresser/tags/4.4.4/inc/AppPresser_Ajax_Extras.php#L31
Resource: N/A
Hyperlink: https://plugins.trac.wordpress.org/browser/apppresser/tags/4.4.4/inc/AppPresser_WPAPI_Mods.php#L92
Resource: N/A
Hyperlink: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3168744%40apppresser&new=3168744%40apppresser&sfp_email=&sfph_mail=
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Vendor
apppresser
Product
apppresser
CPEs
  • cpe:2.3:a:apppresser:apppresser:*:*:*:*:*:wordpress:*:*
Default Status
unaffected
Versions
Affected
  • From 0 through 4.4.4 (semver)
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:security@wordfence.com
Published At:16 Oct, 2024 | 02:15
Updated At:17 May, 2025 | 02:49

The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.4.4. This is due to the appp_reset_password() and validate_reset_password() functions not having enough controls to prevent a successful brute force attack of the OTP to change a password, or verify that a password reset request came from an authorized user. This makes it possible for unauthenticated attackers to generate and brute force an OTP that makes it possible to change any users passwords, including an administrator.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.18.1HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary3.19.8CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Type: Secondary
Version: 3.1
Base score: 8.1
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Type: Primary
Version: 3.1
Base score: 9.8
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE Matches
apppresser
apppresser
>>apppresser>>Versions before 4.4.5(exclusive)
cpe:2.3:a:apppresser:apppresser:*:*:*:*:*:wordpress:*:*
Weaknesses
CWE IDTypeSource
CWE-640Secondarysecurity@wordfence.com
CWE ID: CWE-640
Type: Secondary
Source: security@wordfence.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://plugins.trac.wordpress.org/browser/apppresser/tags/4.4.4/inc/AppPresser_Ajax_Extras.php#L31security@wordfence.com
Product
https://plugins.trac.wordpress.org/browser/apppresser/tags/4.4.4/inc/AppPresser_WPAPI_Mods.php#L92security@wordfence.com
Product
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3168744%40apppresser&new=3168744%40apppresser&sfp_email=&sfph_mail=security@wordfence.com
Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/45647fa6-a98d-4eb4-a287-f523e434688b?source=cvesecurity@wordfence.com
Third Party Advisory
Hyperlink: https://plugins.trac.wordpress.org/browser/apppresser/tags/4.4.4/inc/AppPresser_Ajax_Extras.php#L31
Source: security@wordfence.com
Resource:
Product
Hyperlink: https://plugins.trac.wordpress.org/browser/apppresser/tags/4.4.4/inc/AppPresser_WPAPI_Mods.php#L92
Source: security@wordfence.com
Resource:
Product
Hyperlink: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3168744%40apppresser&new=3168744%40apppresser&sfp_email=&sfph_mail=
Source: security@wordfence.com
Resource:
Patch
Hyperlink: https://www.wordfence.com/threat-intel/vulnerabilities/id/45647fa6-a98d-4eb4-a287-f523e434688b?source=cve
Source: security@wordfence.com
Resource:
Third Party Advisory

Change History

0
Information is not available yet

Similar CVEs

56Records found
CVE-2022-37300
Matching Score-4
Assigner-Schneider Electric
ShareView Details
Matching Score-4
Assigner-Schneider Electric
CVSS Score-9.8||CRITICAL
EPSS-0.29% / 51.86%
||
7 Day CHG~0.00%
Published-12 Sep, 2022 | 17:40
Updated-03 Aug, 2024 | 10:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the controller when communicating over Modbus. Affected Products: EcoStruxure Control Expert Including all Unity Pro versions (former name of EcoStruxure Control Expert) (V15.0 SP1 and prior), EcoStruxure Process Expert, Including all versions of EcoStruxure Hybrid DCS (former name of EcoStruxure Process Expert) (V2021 and prior), Modicon M340 CPU (part numbers BMXP34*) (V3.40 and prior), Modicon M580 CPU (part numbers BMEP* and BMEH*) (V3.20 and prior).

Action-Not Available
Vendor-
Product-modicon_m340_bmxp342030_firmwaremodicon_m340_bmxp3420302h_firmwaremodicon_m340_bmxp342020h_firmwaremodicon_m580_bmep583040_firmwaremodicon_m580_bmeh582040smodicon_m340_bmxp3420302_firmwaremodicon_m340_bmxp342010modicon_m580_bmeh584040smodicon_m580_bmep582020h_firmwaremodicon_m580_bmep584040s_firmwaremodicon_m580_bmep584040modicon_m340_bmxp342010_firmwaremodicon_m340_bmxp342020_firmwaremodicon_m340_bmxp3420102_firmwaremodicon_m580_bmep585040_firmwaremodicon_m580_bmep582040h_firmwaremodicon_m580_bmep584040_firmwaremodicon_m580_bmep584040smodicon_m580_bmeh582040cmodicon_m580_bmep583040ecostruxure_control_expertmodicon_m580_bmep582040modicon_m580_bmep584020_firmwaremodicon_m580_bmeh584040modicon_m580_bmep585040modicon_m580_bmep585040c_firmwaremodicon_m580_bmeh584040_firmwaremodicon_m580_bmep581020h_firmwaremodicon_m580_bmep584020modicon_m580_bmeh584040s_firmwaremodicon_m340_bmxp342020modicon_m340_bmxp342030hmodicon_m340_bmxp342020hmodicon_m580_bmeh586040cmodicon_m580_bmep582020_firmwaremodicon_m340_bmxp342000_firmwaremodicon_m580_bmeh586040_firmwaremodicon_m580_bmep581020hmodicon_m580_bmeh584040cmodicon_m340_bmxp342030modicon_m580_bmeh586040c_firmwaremodicon_m580_bmep586040_firmwaremodicon_m580_bmeh582040_firmwaremodicon_m580_bmep582040_firmwaremodicon_m580_bmeh582040modicon_m580_bmeh582040c_firmwaremodicon_m580_bmep583020modicon_m580_bmeh586040s_firmwaremodicon_m580_bmeh586040smodicon_m580_bmep586040modicon_m340_bmxp342000modicon_m580_bmeh586040modicon_m580_bmep582020modicon_m580_bmep583020_firmwaremodicon_m340_bmxp341000modicon_m580_bmeh584040c_firmwaremodicon_m340_bmxp3420302hmodicon_m580_bmep585040cmodicon_m580_bmep582040hmodicon_m340_bmxp3420302modicon_m340_bmxp341000_firmwaremodicon_m580_bmep581020_firmwareecostruxure_process_expertmodicon_m580_bmep581020modicon_m580_bmep586040cmodicon_m340_bmxp342030h_firmwaremodicon_m580_bmep582020hmodicon_m580_bmep586040c_firmwaremodicon_m340_bmxp3420102modicon_m580_bmeh582040s_firmwareEcoStruxure Control ExpertEcoStruxure Process ExpertModicon M340 CPUModicon M580 CPU
CWE ID-CWE-640
Weak Password Recovery Mechanism for Forgotten Password
CVE-2018-16529
Matching Score-4
Assigner-Forcepoint
ShareView Details
Matching Score-4
Assigner-Forcepoint
CVSS Score-9.8||CRITICAL
EPSS-0.36% / 57.53%
||
7 Day CHG~0.00%
Published-28 Mar, 2019 | 16:02
Updated-05 Aug, 2024 | 10:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A password reset vulnerability has been discovered in Forcepoint Email Security 8.5.x. The password reset URL can be used after the intended expiration period or after the URL has already been used to reset a password.

Action-Not Available
Vendor-forcepointForcepoint
Product-email_securityForcepoint Email Security
CWE ID-CWE-640
Weak Password Recovery Mechanism for Forgotten Password
CVE-2024-38287
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.1||CRITICAL
EPSS-0.50% / 64.70%
||
7 Day CHG~0.00%
Published-25 Jul, 2024 | 00:00
Updated-13 Aug, 2024 | 13:34
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to force the application into resetting the administrator's password to a random insecure 8-digit value.

Action-Not Available
Vendor-rhubcomn/ar-hub
Product-turbomeetingn/aturbomeeting
CWE ID-CWE-640
Weak Password Recovery Mechanism for Forgotten Password
CVE-2024-38468
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.15% / 35.59%
||
7 Day CHG+0.03%
Published-16 Jun, 2024 | 00:00
Updated-26 Mar, 2025 | 16:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized password resets via the resetPassword API.

Action-Not Available
Vendor-guoxinledn/a
Product-synthesis_image_systemn/a
CWE ID-CWE-640
Weak Password Recovery Mechanism for Forgotten Password
CVE-2024-2862
Matching Score-4
Assigner-LG Electronics
ShareView Details
Matching Score-4
Assigner-LG Electronics
CVSS Score-9.1||CRITICAL
EPSS-42.36% / 97.36%
||
7 Day CHG~0.00%
Published-25 Mar, 2024 | 06:31
Updated-01 Apr, 2025 | 17:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Password reset vulnerability without authorization on LG LED Assistant

This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.

Action-Not Available
Vendor-LG Electronics Inc.
Product-lg_led_assistantLG LED Assistantlg_led_assistant
CWE ID-CWE-287
Improper Authentication
CWE ID-CWE-640
Weak Password Recovery Mechanism for Forgotten Password
CVE-2024-45670
Matching Score-4
Assigner-IBM Corporation
ShareView Details
Matching Score-4
Assigner-IBM Corporation
CVSS Score-5.6||MEDIUM
EPSS-0.06% / 19.55%
||
7 Day CHG~0.00%
Published-14 Nov, 2024 | 11:50
Updated-16 Nov, 2024 | 00:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
IBM Security SOAR weak password recovery mechanism

IBM Security SOAR 51.0.1.0 and earlier contains a mechanism for users to recover or change their passwords without knowing the original password, but the user account must be compromised prior to the weak recovery mechanism.

Action-Not Available
Vendor-IBM Corporation
Product-soarSecurity SOAR
CWE ID-CWE-640
Weak Password Recovery Mechanism for Forgotten Password
  • Previous
  • 1
  • 2
  • Next
Details not found