// For flags

CVE-2024-9862

Miniorange OTP Verification with Firebase <= 3.6.0 - Unauthenticated Arbitrary User Password Change

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 3.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources, and the user current password check is missing. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.

El complemento Miniorange OTP Verification con Firebase para WordPress es vulnerable a cambios arbitrarios de contraseñas de usuario en versiones hasta la 3.6.0 incluida. Esto se debe a que el complemento proporciona acceso controlado por el usuario a los objetos, lo que permite que un usuario omita la autorización y acceda a los recursos del sistema, y no se verifica la contraseña actual del usuario. Esto hace posible que atacantes no autenticados cambien las contraseñas de los usuarios y potencialmente se apropien de las cuentas de administrador.

*Credits: István Márton
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-10-11 CVE Reserved
  • 2024-10-16 CVE Published
  • 2024-10-17 CVE Updated
  • 2024-10-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-639: Authorization Bypass Through User-Controlled Key
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cyberlord92
Search vendor "Cyberlord92"
 Miniorange OTP Verification With Firebase
Search vendor "Cyberlord92" for product "Miniorange OTP Verification With Firebase"
 <= 3.6.0
Search vendor "Cyberlord92" for product "Miniorange OTP Verification With Firebase" and version " <= 3.6.0"
en
Affected