CVE-2024-50653 Business logic in n/a
Attackers can bypass coupon claim limits by sending repeated requests, allowing unlimited coupon collection in CRMEB.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-50653?
CVE-2024-50653 is a high-severity vulnerability in n/a, published on 15 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CRMEB <=5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end restriction of only being able to claim coupons once by capturing packets and sending a large number of data packets for coupon collection, achieving unlimited coupon collection.
Weakness: CWE-284
Which versions are affected by CVE-2024-50653?
It affects 1 product.
Products include Crmeb Crmeb.
How do I fix CVE-2024-50653?
No fix has been published for CVE-2024-50653 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-50653 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-50653 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-f927-34r4-vxxw.