CVE-2024-57604 MaysWind ezBookkeeping has Improper Privilege Management
A remote attacker can escalate privileges in ezBookkeeping via the token component, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-57604?
CVE-2024-57604 is a critical vulnerability in n/a, published on 12 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the token component.
Weakness: CWE-276
Which versions are affected by CVE-2024-57604?
3 open source packages ship an affected version, including github.com/mayswind/ezbookkeeping. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/mayswind/ezbookkeeping Go | All versions | None |
github.com/mayswind/ezbookkeeping Go | All versions to 0.7.0 | None |
github.com/mayswind/ezbookkeeping Go | All versions to 0.7.0 | None |
Products include Mayswind Ezbookkeeping.
How do I fix CVE-2024-57604?
Upgrade to a fixed version.
Is CVE-2024-57604 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-57604 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-mpg8-8x9c-p9gv, GO-2025-3474.