CVE-2024-6328 — Authentication Bypass Using an Alternate Path or Channel in Mstore API

CWE-288 — Authentication Bypass Using an Alternate Path or ChannelCWE-862 — Missing Authorization3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
0.6%
top 31.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Inspireui Mstore APIInspireui Mstore API Create Native Android IOS Apps ON THE Cloud
Timeline
PublishedJul 12

Description

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.14.7. This is due to insufficient verification on the 'phone' parameter of the 'firebase_sms_login' and 'firebase_sms_login_v2' functions. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email address or phone number. Additionally, if …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDinspireui/mstore_api< 4.15.0

Patches

Patch: plugins.trac.wordpress.org ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
CVEList
MStore API – Create Native Android & iOS Apps On The Cloud <= 4.14.7 - Authentication Bypass↗2024-07-12
▶
GHSA
GHSA-xgv9-3cm6-qccq: The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and↗2024-07-12
▶
CVE-2024-6328 — Inspireui Mstore API vulnerability | cvebase