CVE-2024-23733

Summary

CVE-2024-23733 is a vulnerability affecting Software AG's webMethods Integration Server version 10.15.0 and below. Attackers can exploit this issue by sending an arbitrary username and an empty password to the /WmAdmin/#/login/ URI in the /WmAdmin/,/invoke/vm.server/login login page. Successful exploitation grants unauthorized access to the administration panel, allowing attackers to discover the hostname and version information of the targeted system. This vulnerability poses a significant risk for potential unauthorized system access and data exposure. It is strongly recommended that users apply the relevant patch or upgrade to a secure version as soon as possible.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.