CVE-2023-24688 Auth bypass in n/a
Unauthenticated attackers can register accounts in MojoPortal even when user registration is disabled, potentially leading to unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-24688?
CVE-2023-24688 is a medium-severity authentication bypass vulnerability in n/a, published on 9 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue in Mojoportal v2.7.0.0 allows an unauthenticated attacker to register a new user even if the Allow User Registrations feature is disabled.
Weakness: CWE-284
Which versions are affected by CVE-2023-24688?
It affects 1 product.
Products include Mojoportal Mojoportal.
How do I fix CVE-2023-24688?
No fix has been published for CVE-2023-24688 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-24688 being exploited?
There is no known exploitation of CVE-2023-24688 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-9x9w-38h4-6344.