How severe is CVE-2024-8485?

This vulnerability has a severity rating of CRITICAL with a CVSS score of 9.8 out of 10.

What type of vulnerability is CVE-2024-8485?

This is classified as CWE-639, which is a common weakness in software security.

CVE-2024-8485 - CRITICAL Severity | CVSS 9.8

Vulnerability Description

The REST API TO MiniProgram plugin for WordPress is vulnerable to privilege escalation via account takeovr in all versions up to, and including, 4.7.1 via the updateUserInfo() due to missing validation on the 'openid' user controlled key that determines what user will be updated. This makes it possible for unauthenticated attackers to update arbitrary user's accounts, including their email to a @weixin.com email, which can the be leveraged to reset the password of the user's account, including administrators.

Related Vulnerabilities

CVE-2019-12866

CRITICAL

CVSS:9.8(Critical)

An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains YouTrack. The issue was fixed in 2018.4.49168.

CWE-6392019

CVE-2019-13360

CRITICAL

CVSS:9.8(Critical)

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging knowledge of a valid username.

CWE-6392019

CVE-2019-15913

CRITICAL

CVSS:9.8(Critical)

An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM devices. Because of insecure key transport in ZigBee communication, causing attackers to gain sensitive informat...

CWE-6392019

CVE-2019-9756

CRITICAL

CVSS:9.8(Critical)

An issue was discovered in GitLab Community and Enterprise Edition 10.x (starting from 10.8) and 11.x before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It has Incorrect Access Control, a...

CWE-6392019

CVE-2020-11658

CRITICAL

CVSS:9.8(Critical)

CA API Developer Portal 4.3.1 and earlier handles shared secret keys in an insecure manner, which allows attackers to bypass authorization.

CWE-6392020

CVE-2021-37184

CRITICAL

CVSS:9.8(Critical)

A vulnerability has been identified in Industrial Edge Management (All versions < V1.3). An unauthenticated attacker could change the the password of any user in the system under certain circumstances...

CWE-6392021