CVE-2024-50672

Summary

CVE-2024-50672 is a NoSQL injection vulnerability affecting Adapt Learning Adapt Authoring Tool versions below 0.11.3. This issue allows unauthenticated attackers to manipulate user input in the "Reset password" feature, which is then used as a query in Mongoose's find() function. By exploiting this vulnerability, attackers can reset both user and administrator account passwords, leading to a full takeover of the administrator account. Subsequently, the attacker can upload a custom plugin for remote code execution (RCE) on the hosting server, escalating the attack's impact.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.