CVE-2024-47654: high-severity vulnerability in Shilpi Computers Client Dashboard
No Rate Limiting vulnerability
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.5%
This vulnerability exists in Shilpi Client Dashboard due to lack of rate limiting and Captcha protection for OTP requests in certain API endpoint. An unauthenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoints, which could lead to the OTP bombing on the targeted system.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
Shilpi Computers · Client DashboardRelated CVEs — Shilpi Computers Client Dashboard
In the same product, most dangerous first.
CVE-2024-47655HIGHUnrestricted File Upload VulnerabilityEPSS 0.7%CVE-2024-47656CRITICALUser Enumeration vulnerabilityEPSS 0.5%CVE-2024-47651HIGHParameter Pollution VulnerabilityEPSS 0.4%CVE-2024-47652HIGHInsecure Authentication VulnerabilityEPSS 0.4%CVE-2024-47653HIGHMissing Authorization VulnerabilityEPSS 0.3%