Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2024-24573 Details

Description

facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, when a user updates their profile, a POST request containing user information is sent to the endpoint server/fm-modules/facileManager/ajax/processPost.php. It was found that non-admins can arbitrarily set their permissions and grant their non-admin accounts with super user privileges.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/WillyXJ/facileManager/commit/0aa850d4b518f10143a4c675142b15caa5872877 CVEPatch
https://github.com/WillyXJ/facileManager/security/advisories/GHSA-w67q-pp62-j4pf CVEExploitVendor Advisory
https://github.com/WillyXJ/facileManager/commit/0aa850d4b518f10143a4c675142b15caa5872877 [email protected]Patch
https://github.com/WillyXJ/facileManager/security/advisories/GHSA-w67q-pp62-j4pf [email protected]ExploitVendor Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-863Incorrect Authorization[email protected]
CWE-863Incorrect Authorization[email protected]

Affected Products

ProductVersions
facilemanager facilemanager
< 4.5.1

CPE

  • cpe:2.3:a:facilemanager:facilemanager:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

6 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2024-24573
NVD Published Date:
Jan 31, 2024
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2024-24573 Details - Not Deferred