CVE-2024-3123 HIGH

CVE-2024-3123: CHANGING Mobile One Time Password - Arbitrary File Upload

Vendor Changing
Product Mobile One Time Password
Weakness CWE-434 · Unrestricted file upload
Published July 1, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

CHANGING Mobile One Time Password's uploading function in a hidden page does not filter file type properly. Remote attackers with administrator privilege can exploit this vulnerability to upload and run malicious file to execute system commands.

Key dates

02Disclosure timeline

July 1, 2024 CVE published
August 1, 2024 Record updated