Vulnerability · Published Dec 11, 2024 · Assigned by VulDB
CVE-2024-12483Dromara UJCMS User ID id authorization
Low 3.7
In plain English
A low-severity authorization bypass via user-controlled key in UJCMS from Dromara. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 89% of all known vulnerabilities).
Official description
A vulnerability classified as problematic has been found in Dromara UJCMS up to 9.6.3. This affects an unknown part of the file /users/id of the component User ID Handler. The manipulation leads to authorization bypass. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.
Affected products (as reported)
Weakness: CWE-639, CWE-285 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- VDB-287865 | Dromara UJCMS User ID id authorization vdb-entry
- VDB-287865 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #458895 | Dromara UJCMS 9.6.3 Insecure Direct Object Reference (IDOR) third-party-advisory
- https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/IDOR-UsernameEnumeration.md exploit