CVE-2024-57698
An issue in modernwms v.1.0 allows an attacker view the MD5 hash of the administrator password and other attributes without authentication, even after...
- Published
- Apr 29, 2025
- Updated
- Apr 30, 2025
- Assigning CNA
- mitre
- Evidence observed
- Aug 4, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NLow · next 30 days
- Percentile
- 32.8%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
An issue in modernwms v.1.0 allows an attacker view the MD5 hash of the administrator password and other attributes without authentication, even after initial configuration and password change. This happens due to excessive exposure of information and the lack of adequate access control on the /user/list?culture=en-us endpoint.
Sources
1- xpl-ModernWMS-CVE-2024-57698Exploit
It is possible to view the MD5 hash of the admin password and other attributes without authentication, even after initial setup and password change. This is due to excessive information exposure, lack of session management, and inadequate access control on the /user/list?culture=en-us endpoint.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.