{"id":"CVE-2024-50653","aliases":["EUVD-2024-44989","GHSA-f927-34r4-vxxw"],"status":"published","title":"CRMEB \u003c=5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end...","description":"CRMEB \u003c=5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end restriction of only being able to claim coupons once by capturing packets and sending a large number of data packets for coupon collection, achieving unlimited coupon collection.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00527,"percentile":0.44896,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2024-11-15T00:00:00Z","modified":"2026-10-28T02:30:44Z","products":[{"vendor":"crmeb","product":"crmeb"}],"references":[{"url":"https://github.com/crmeb","tags":["Product","web"]},{"url":"https://github.com/Yllxx03/CVE/tree/main/CVE-2024-50653","tags":["Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50653","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f927-34r4-vxxw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50653.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-50653","description":"CRMEB \u003c=5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end restriction of only being able to claim coupons once by capturing packets and sending a large number of data packets for coupon collection, achieving unlimited coupon collection.","status":"published","published":"2024-11-15T00:00:00Z","modified":"2025-03-13T15:33:35.951Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:34:21.784174Z"}],"euvd":[{"id":"EUVD-2024-44989","description":"CRMEB \u003c=5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end restriction of only being able to claim coupons once by capturing packets and sending a large number of data packets for coupon collection, achieving unlimited coupon collection.","status":"published","published":"2024-11-15T00:00:00Z","modified":"2025-03-13T15:33:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:53:04.82001Z"}],"ghsa":[{"id":"GHSA-f927-34r4-vxxw","title":"CRMEB \u003c=5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end...","description":"CRMEB \u003c=5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end restriction of only being able to claim coupons once by capturing packets and sending a large number of data packets for coupon collection, achieving unlimited coupon collection.","status":"published","published":"2024-11-15T18:30:51Z","modified":"2025-03-13T18:32:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:00:16.082166Z"}],"nvd":[{"id":"CVE-2024-50653","description":"CRMEB \u003c=5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end restriction of only being able to claim coupons once by capturing packets and sending a large number of data packets for coupon collection, achieving unlimited coupon collection.","status":"published","published":"2024-11-15T17:15:20.417Z","modified":"2026-06-17T08:04:53.053Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:10:37.281254Z"}],"osv":[{"id":"CVE-2024-50653","description":"CRMEB \u003c=5.4.0 is vulnerable to Incorrect Access Control. Users can bypass the front-end restriction of only being able to claim coupons once by capturing packets and sending a large number of data packets for coupon collection, achieving unlimited coupon collection.","status":"published","published":"2024-11-15T00:00:00Z","modified":"2026-10-28T02:30:44.704814342Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:44.032344Z"}]}}