CVE-2024-57434
Published: 31 January 2025
Description
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
Security Summary
CVE-2024-57434 is an Incorrect Access Control vulnerability (CWE-863) in macrozheng mall-tiny version 1.0.1. The affected application imports users by default upon setup, automatically assigning the test user super administrator privileges. This flaw has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-01-31.
The vulnerability can be exploited by a low-privileged authenticated user (PR:L) over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation grants the attacker super administrator access, enabling high-impact compromise of confidentiality, integrity, and availability (C:H/I:H/A:H).
Mitigation guidance is available in the referenced advisory at https://github.com/peccc/restful_vul/blob/main/mall_tiny_weak_password/mall_tiny_weak_password.md.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Incorrect access control vulnerability provides a default test user with super administrator privileges, enabling adversaries to use default accounts for initial access.