CVE-2024-28735 Auth bypass in n/a
An authenticated user can bypass authorization controls to modify any other user's password, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-28735?
CVE-2024-28735 is a high-severity authentication bypass vulnerability in n/a, published on 20 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Unit4 Financials by Coda versions prior to 2023Q4 suffer from an incorrect access control authorization bypass vulnerability which allows an authenticated user to modify the password of any user of the application via a crafted request.
Weakness: CWE-287
Which versions are affected by CVE-2024-28735?
It affects 1 product.
Products include Unit4 Financials by Coda.
How do I fix CVE-2024-28735?
No fix has been published for CVE-2024-28735 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-28735 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-28735 exists.
Sources
Also known as GHSA-2647-rch5-5qg9.