CVE-2024-9861highCWE-288

CVE-2024-9861: falha de alta gravidade em cyberlord92 Miniorange OTP Verification with…

Miniorange OTP Verification with Firebase <= 3.6.0 - Authentication Bypass

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Miniorange OTP Verification with Firebase

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 0.6%
The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.6.0. This is due to missing validation on the token being supplied during the otp login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the phone number associated with that user.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
cyberlord92 · Miniorange OTP Verification with Firebase
CVEs relacionadas — cyberlord92 Miniorange OTP Verification with…

No mesmo produto, das mais perigosas para as menos.

CVE-2024-9862CRITICALMiniorange OTP Verification with Firebase <= 3.6.0 - Unauthenticated Arbitrary User Password ChangeEPSS 0.6%CVE-2024-9863CRITICALMiniorange OTP Verification with Firebase <= 3.6.0 - Privilege Escalation via Registration due to Administrator Default User Role ValueEPSS 0.6%CVE-2025-7665HIGHMiniorange OTP Verification with Firebase 3.1.0 - 3.6.2 - Unauthenticated Privilege EscalationEPSS 0.4%