CVE-2023-53895criticalCWE-285

PimpMyLog 1.7.14 Improper Access Control via Account Creation Endpoint

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.3epss 0.7%

probabilidad de explotación

0.7%top 49% de las CVE

explotación observada

noninguna fuente lo reporta

PimpMyLog 1.7.14 contains an improper access control vulnerability that allows remote attackers to create admin accounts without authorization through the configuration endpoint. Attackers can exploit the unsanitized username field to inject malicious JavaScript, create a hidden backdoor account, and potentially access sensitive server-side log information and environmental variables.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Productos afectados

Pimpmylog · PimpMyLog

Referencias

https://github.com/potsky/PimpMyLog https://www.exploit-db.com/exploits/51593 https://www.pimpmylog.com/https://www.vulncheck.com/advisories/pimpmylog-improper-access-control-via-account-creation-endpoint