CVE-2024-32003

Summary

CVE-2024-32003: A vulnerability was discovered in the wn-dusk-plugin for Winter CMS, which integrates Laravel Dusk into the platform for browser testing. The plugin provides special routes that allow unauthenticated access to user accounts in the Backend or User plugin if the plugin is publicly available and test cases are run with live data. This vulnerability only affects installations that meet specific criteria, including being in production mode, having overridden the Dusk plugin's configuration, and using production data for testing instead of the default SQLite database. The issue has been addressed in version 2.1.0, and users are advised to upgrade to mitigate the risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.