CVE-2024-24573

    Dashboard / Vulnerabilities / CVE-2024-24573

    CVE-2024-24573

    Published: 31 Jan 2024Last Modified: 28 Oct 2026

    Summary: facileManager Privilege Escalation via Mass Assignment

    Details: facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, when a user updates their profile, a POST request containing user information is sent to the endpoint server/fm-modules/facileManager/ajax/processPost.php. It was found that non-admins can arbitrarily set their permissions and grant their non-admin accounts with super user privileges.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24573.json, https://github.com/WillyXJ/facileManager/security/advisories/GHSA-w67q-pp62-j4pf, https://nvd.nist.gov/vuln/detail/CVE-2024-24573, https://github.com/WillyXJ/facileManager/commit/0aa850d4b518f10143a4c675142b15caa5872877

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -0aa850d4b518f10143a4c675142b15caa5872877

    Affected versions

    v4.5.0-complete

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-24573 | CVE-DB