CVE-2024-55585

CVSS 9 CRITICALEPSS 0.4%CWE-306

Vexday Risk Score

28Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 9EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

07 jun 2025Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

In the moPS App through 1.8.618, all users can access administrative API endpoints without additional authentication, resulting in unrestricted read and write access, as demonstrated by /api/v1/users/resetpassword.

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:N/RE:M/U:Red

Productos afectados

MOPS · moPS

Referencias

https://karatemuffin.it/data/2025_06_07_CVE-2024-55585_update.json https://media.ccc.de/v/glt25-504-safety-ja-security-nein-analyse-eines-breit-eingesetzten-einsatzmanagmentsystems-https://mops.eu https://www.mops.eu