CVE-2024-28735

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-03-20 · updated 2026-07-09
Weakness: CWE-287

Description

Unit4 Financials by Coda versions prior to 2023Q4 suffer from an incorrect access control authorization bypass vulnerability which allows an authenticated user to modify the password of any user of the application via a crafted request.

Affected products

Unit4 Financials By Coda: before 2023q4 — fixed in 2023q4

How to fix

Upgrade to a fixed version: Unit4 Financials By Coda 2023q4. Check the vendor advisory for mitigations.

References

https://packetstormsecurity.com/files/177620/Financials-By-Coda-Authorization-Bypass.html
https://www.unit4.com/
https://www.unit4.com/products/financial-management-software
https://packetstormsecurity.com/files/177620/Financials-By-Coda-Authorization-Bypass.html
https://www.unit4.com/
https://www.unit4.com/products/financial-management-software

Get alerted when CVE-2024-28735 or the next vulnerability affects your stack