CVE-2024-2412
Heimavista Rpage and Epage - Broken Access Control
- State
- Published
- Severity
- 5.3 Medium
- Published
- Mar 13, 2024
- Updated
- Oct 14, 2024
- Reserved
- Mar 13, 2024
Description
The disabling function of the user registration page for Heimavista Rpage and Epage is not properly implemented, allowing remote attackers to complete user registration on sites where user registration is supposed to be disabled.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | twcert |
Weaknesses
- CWE-1220 Insufficient Granularity of Access Control
Affected Products
| Product | Versions |
|---|---|
RpageHeimavista |
|
EpageHeimavista |
|
References
- https://www.twcert.org.tw/tw/cp-132-7696-0951f-1.htmlthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.