CVE-2024-41617

State: Published
Severity: 9.8 Critical
Published: Oct 24, 2024
Updated: Oct 29, 2024
Reserved: Jul 18, 2024

Description

Money Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to Incorrect Access Control. The `redirect_if_not_loggedin` function in `functions_security.php` fails to terminate script execution after redirecting unauthenticated users. This flaw allows an unauthenticated attacker to upload arbitrary files, potentially leading to Remote Code Execution.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://github.com/moneymanagerex/web-money-manager-ex/issues/51
https://youtu.be/JaOrlT9G3yo?t=88
https://github.com/moneymanagerex/web-money-manager-ex/commit/f2850b295ee21bc299799343a3bc4d004d05651d
https://github.com/moneymanagerex/web-money-manager-ex/releases/tag/v1.2.3

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.