CVE-2024-24621

CRITICAL

Softaculous Webuzo < 4.2.9 - Unauthenticated Authentication Bypass via Password Reset

Title source: llm

Description

Softaculous Webuzo contains an authentication bypass vulnerability through the password reset functionality. Remote, anonymous attackers can exploit this vulnerability to gain full server access as the root user.

References (1)

Core 1

Core References

Third Party Advisory third-party-advisory

https://blog.exodusintel.com/2024/07/25/softaculous-webuzo-authentication-bypass/

Scores

CVSS v3 9.8

EPSS 0.0116

EPSS Percentile 62.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-697

Status published

Products (1)

softaculous/webuzo < 4.2.9

Published Jul 25, 2024

Tracked Since Feb 18, 2026