CVE-2024-50672

A NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to reset user and administrator account passwords via the "Reset password" feature. The vulnerability occurs due to insufficient validation of user input, which is used as a query in Mongoose's find() function. This makes it possible for attackers to perform a full takeover of the administrator account. Attackers can then use the newly gained administrative privileges to upload a custom plugin to perform remote code execution (RCE) on the server hosting the web application.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

1.57% chance of exploitation in the next 30 days, 74th percentile

Published

2024-11-25

Updated

2024-11-27

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52208

References

• CVE Record
• NVD entry

Related

• CVE-2024-5067
• CVE-2024-50677
• CVE-2024-50667
• CVE-2024-5069
• CVE-2024-50665
• CVE-2024-5071