Exploitation Summary
EIP tracks 2 public exploits for CVE-2024-23733. PoCs published by Rasime Ekici, ekcrsm.
AI-analyzed exploit summary This exploit describes an authentication bypass vulnerability in WebMethods Integration Server 10.15.0.0000-0092, allowing remote attackers to access the administration panel and discover server hostname, version information, and administrative API endpoints by sending a dummy username with a blank password.
Description
The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core_Fix7 allows remote attackers to reach the administration panel and discover hostname and version information by sending an arbitrary username and a blank password to the /WmAdmin/#/login/ URI.
Exploits (2)
This exploit describes an authentication bypass vulnerability in WebMethods Integration Server 10.15.0.0000-0092, allowing remote attackers to access the administration panel and discover server hostname, version information, and administrative API endpoints by sending a dummy username with a blank password.
The repository describes an incorrect access control vulnerability in Software AG webMethods API Integration Server 10.15.0, where sending a blank password with an arbitrary username allows access to the administrative dashboard, exposing hostname and version information. The writeup provides technical details about the affected components and attack vectors.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N