How severe is CVE-2024-13772?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 5.9 out of 10.

What type of vulnerability is CVE-2024-13772?

This is classified as CWE-288, which is a common weakness in software security.

CVE-2024-13772 - MEDIUM Severity | CVSS 5.9

Vulnerability Description

The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.4. This is due to a lack of randomization of a password created during Single Sign-On via Google or Facebook. This makes it possible for unauthenticated attackers to change the password of arbitrary Candidate-level users if the attacker knows the username assigned to the victim during account creation.

Related Vulnerabilities

CVE-2024-13771

MEDIUM

CVSS:5.9(Medium)

CWE-2882024

CVE-2019-5453

MEDIUM

CVSS:6.1(Medium)

Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted for the lock protection and switching to the Nextcloud file provider.

CWE-2882019

CVE-2022-40725

MEDIUM

CVSS:6.1(Medium)

PingID Desktop prior to the latest released version 1.7.4 contains a vulnerability that can be exploited to bypass the maximum PIN attempts permitted before the time-based lockout is activated.

CWE-2882022

CVE-2021-41992

MEDIUM

CVSS:5.6(Medium)

A misconfiguration of RSA in PingID Windows Login prior to 2.7 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass.

CWE-2882021

CVE-2020-10048

MEDIUM

CVSS:5.5(Medium)

A vulnerability has been identified in SIMATIC PCS 7 (All versions), SIMATIC WinCC (All versions < V7.5 SP2). Due to an insecure password verification process, an attacker could bypass the password pr...

CWE-2882020

CVE-2020-11005

MEDIUM

CVSS:5.5(Medium)

The WindowsHello open source library (NuGet HaemmerElectronics.SeppPenner.WindowsHello), before version 1.0.4, has a vulnerability where encrypted data could potentially be decrypted without needing a...

CWE-2882020