CVE-2024-9861highCWE-288

CVE-2024-9861: fallo de gravedad alta en cyberlord92 Miniorange OTP Verification with…

Miniorange OTP Verification with Firebase <= 3.6.0 - Authentication Bypass

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Miniorange OTP Verification with Firebase

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.1epss 0.6%
The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.6.0. This is due to missing validation on the token being supplied during the otp login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the phone number associated with that user.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
cyberlord92 · Miniorange OTP Verification with Firebase
CVEs relacionadas — cyberlord92 Miniorange OTP Verification with…

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-9862CRITICALMiniorange OTP Verification with Firebase <= 3.6.0 - Unauthenticated Arbitrary User Password ChangeEPSS 0.6%CVE-2024-9863CRITICALMiniorange OTP Verification with Firebase <= 3.6.0 - Privilege Escalation via Registration due to Administrator Default User Role ValueEPSS 0.6%CVE-2025-7665HIGHMiniorange OTP Verification with Firebase 3.1.0 - 3.6.2 - Unauthenticated Privilege EscalationEPSS 0.4%