CVE-2024-6425 CRITICAL

CVE-2024-6425: Incorrect Provision of Specified Functionality vulnerability in MESbook

Vendor Mesbook
Product MESbook
Weakness CWE-684
Published July 1, 2024
Last update August 1, 2024
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can register user accounts without being authenticated from the route "/account/Register/" and in the parameters "UserName=<RANDOMUSER>&Password=<PASSWORD>&ConfirmPassword=<PASSWORD-REPEAT>".

Key dates

02Disclosure timeline

July 1, 2024 CVE published
August 1, 2024 Record updated