CVE-2023-53895criticalCWE-285

PimpMyLog 1.7.14 Improper Access Control via Account Creation Endpoint

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 0.7%

probabilidade de exploração

0.7%top 49% das CVEs

exploração observada

nãonenhuma fonte reporta

PimpMyLog 1.7.14 contains an improper access control vulnerability that allows remote attackers to create admin accounts without authorization through the configuration endpoint. Attackers can exploit the unsanitized username field to inject malicious JavaScript, create a hidden backdoor account, and potentially access sensitive server-side log information and environmental variables.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Produtos afetados

Pimpmylog · PimpMyLog

Referências

https://github.com/potsky/PimpMyLog https://www.exploit-db.com/exploits/51593 https://www.pimpmylog.com/https://www.vulncheck.com/advisories/pimpmylog-improper-access-control-via-account-creation-endpoint