CVE-2024-48955

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-29 · updated 2026-06-17
Weakness: CWE-284

Description

Broken access control in NetAdmin 4.030319 returns data with functionalities on the endpoint that "assembles" the functionalities menus, the return of this call is not encrypted and as the system does not validate the session authorization, an attacker can copy the content of the browser of a user with greater privileges having access to the functionalities of the user that the code was copied.

Affected products

Netadmin: 4.0.30319

References

https://github.com/BrotherOfJhonny/CVE-2024-48955_Overview
https://netadmin.software/gestao-de-identidade-e-acesso/
https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-48955&sortby=bydate

Get alerted when CVE-2024-48955 or the next vulnerability affects your stack