Vulnerabilities > CVE-2024-24573 - Incorrect Authorization vulnerability in Facilemanager

CVSS 8.8 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

facilemanager

CWE-863

NVD

Published: 2024-01-31

Updated: 2024-02-07

Summary

facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, when a user updates their profile, a POST request containing user information is sent to the endpoint server/fm-modules/facileManager/ajax/processPost.php. It was found that non-admins can arbitrarily set their permissions and grant their non-admin accounts with super user privileges.

Vulnerable Configurations

Part	Description	Count
Application	Facilemanager Facilemanager Facilemanager 1.0 Facilemanager Facilemanager 1.0.1 Facilemanager Facilemanager 1.0.2 Facilemanager Facilemanager 1.1 Facilemanager Facilemanager 1.1.1 Facilemanager Facilemanager 1.1.2 Facilemanager Facilemanager 1.2 Facilemanager Facilemanager 1.2.1 Facilemanager Facilemanager 1.2.2 Facilemanager Facilemanager 1.2.3 Facilemanager Facilemanager 1.3 Facilemanager Facilemanager 1.3.1 Facilemanager Facilemanager 2.0 Facilemanager Facilemanager 2.0.1 Facilemanager Facilemanager 2.0.2 Facilemanager Facilemanager 2.0.3 Facilemanager Facilemanager 2.1 Facilemanager Facilemanager 2.1.1 Facilemanager Facilemanager 2.1.2 Facilemanager Facilemanager 2.1.3 Facilemanager Facilemanager 2.1.4 Facilemanager Facilemanager 2.1.5 Facilemanager Facilemanager 2.2 Facilemanager Facilemanager 2.2.1 Facilemanager Facilemanager 2.3 Facilemanager Facilemanager 2.3.1 Facilemanager Facilemanager 2.3.2 Facilemanager Facilemanager 2.3.3 Facilemanager Facilemanager 3.0 Facilemanager Facilemanager 3.0.1 Facilemanager Facilemanager 3.0.2 Facilemanager Facilemanager 3.0.3 Facilemanager Facilemanager 3.1.0 Facilemanager Facilemanager 3.1.1 Facilemanager Facilemanager 3.2 Facilemanager Facilemanager 3.3 Facilemanager Facilemanager 3.4 Facilemanager Facilemanager 3.4.1 Facilemanager Facilemanager 3.4.2 Facilemanager Facilemanager 3.5.0 Facilemanager Facilemanager 3.5.1 Facilemanager Facilemanager 3.5.2 Facilemanager Facilemanager 3.5.3 Facilemanager Facilemanager 3.5.4 Facilemanager Facilemanager 3.5.5 Facilemanager Facilemanager 3.5.6 Facilemanager Facilemanager 3.5.7 Facilemanager Facilemanager 4.0.0 Facilemanager Facilemanager 4.0.1 Facilemanager Facilemanager 4.0.2 Facilemanager Facilemanager 4.0.3 Facilemanager Facilemanager 4.1.0 Facilemanager Facilemanager 4.1.1 Facilemanager Facilemanager 4.1.2 Facilemanager Facilemanager 4.2.0 Facilemanager Facilemanager 4.3.0 Facilemanager Facilemanager 4.4.0 Facilemanager Facilemanager 4.5.0	58

Common Weakness Enumeration (CWE)

CWE-863 - Incorrect Authorization

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References