CVE-2024-47652CWE-308

Insecure Authentication Vulnerability

High · published October 4, 2024

CVSS v4.0
7.6
EPSS
0%
Percentile
34.5
In the wild
Unconfirmed
What it is

This vulnerability exists in Shilpi Client Dashboard due to implementation of inadequate authentication mechanism in the login module wherein access to any users account is granted with just their corresponding mobile number. A remote attacker could exploit this vulnerability by providing mobile number of targeted user, to obtain complete access to the targeted user account.

The record
Technical detail
CVSS v4.0
7.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N
EPSS
0.00413 · 34.5th percentile
Weakness
CWE-308 · Use of Single-factor Authentication
Published
2024-10-04T12:13Z
EPSS history
Timeline
  • 04 OCT 12:13Z
    Insecure Authentication Vulnerability
    cvelistv5