Vulnerability · Published Oct 4, 2024 · Assigned by CERT-In

CVE-2024-47652Insecure Authentication Vulnerability

High 7.6

In plain English

A high-severity security flaw in Client Dashboard from Shilpi Computers. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 4.0)7.6High

Exploit odds (30 days)0.4%top 64.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

This vulnerability exists in Shilpi Client Dashboard due to implementation of inadequate authentication mechanism in the login module wherein access to any users account is granted with just their corresponding mobile number. A remote attacker could exploit this vulnerability by providing mobile number of targeted user, to obtain complete access to the targeted user account.

Affected products (as reported)

Vendor	Product	Versions
Shilpi Computers	Client Dashboard	<9.7.0

Weakness: CWE-308 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0313 third-party-advisory