This is due to improper user check error handling in the two-factor REST API actions with the ‘check_login_and_get_user’ function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the “Two-Factor Authentication” setting is enabled (disabled by default).

CVE ID: CVE-2024-10924

This vulnerability affects the following application versions:

  • Really Simple SSL 9.0.0
  • Really Simple SSL 9.0.2
  • Really Simple SSL 9.1.0
  • Really Simple SSL 9.1.1
  • Really Simple SSL 9.1.1.1

Skriv et svar

Din e-mailadresse vil ikke blive publiceret. Krævede felter er markeret med *