{"id":"CVE-2024-6425","aliases":["EUVD-2024-47528","GHSA-3j2h-mvc8-98cc"],"status":"published","title":"Incorrect Provision of Specified Functionality vulnerability in MESbook","description":"Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can register user accounts without being authenticated from the route \"/account/Register/\" and in the parameters \"UserName=\u003cRANDOMUSER\u003e\u0026Password=\u003cPASSWORD\u003e\u0026ConfirmPassword=\u003cPASSWORD-REPEAT\u003e\".","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00544,"percentile":0.46185,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-684"],"published":"2024-07-01T12:56:20Z","modified":"2026-06-17T08:17:59Z","products":[{"vendor":"mesbook","product":"mesbook"}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-mesbook","tags":["x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6425"},{"url":"https://github.com/advisories/GHSA-3j2h-mvc8-98cc"}],"sources":{"cve":[{"id":"CVE-2024-6425","title":"Incorrect Provision of Specified Functionality vulnerability in MESbook","description":"Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can register user accounts without being authenticated from the route \"/account/Register/\" and in the parameters \"UserName=\u003cRANDOMUSER\u003e\u0026Password=\u003cPASSWORD\u003e\u0026ConfirmPassword=\u003cPASSWORD-REPEAT\u003e\".","status":"published","published":"2024-07-01T12:56:20.984Z","modified":"2024-08-01T21:41:03.276Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-684"],"updated_at":"2026-11-02T14:34:11.305983Z"}],"euvd":[{"id":"EUVD-2024-47528","description":"Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can register user accounts without being authenticated from the route \"/account/Register/\" and in the parameters \"UserName=\u003cRANDOMUSER\u003e\u0026Password=\u003cPASSWORD\u003e\u0026ConfirmPassword=\u003cPASSWORD-REPEAT\u003e\".","status":"published","published":"2024-07-01T12:56:20Z","modified":"2024-08-01T21:41:03Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-03T03:50:32.736279Z"}],"ghsa":[{"id":"GHSA-3j2h-mvc8-98cc","title":"Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An...","description":"Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can register user accounts without being authenticated from the route \"/account/Register/\" and in the parameters \"UserName=\u003cRANDOMUSER\u003e\u0026Password=\u003cPASSWORD\u003e\u0026ConfirmPassword=\u003cPASSWORD-REPEAT\u003e\".","status":"published","published":"2024-07-01T15:32:33Z","modified":"2024-07-01T15:32:34Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-684"],"updated_at":"2026-11-02T14:57:32.670649Z"}],"nvd":[{"id":"CVE-2024-6425","description":"Incorrect Provision of Specified Functionality vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can register user accounts without being authenticated from the route \"/account/Register/\" and in the parameters \"UserName=\u003cRANDOMUSER\u003e\u0026Password=\u003cPASSWORD\u003e\u0026ConfirmPassword=\u003cPASSWORD-REPEAT\u003e\".","status":"published","published":"2024-07-01T13:15:06.927Z","modified":"2026-06-17T08:17:59.447Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-684"],"updated_at":"2026-11-02T14:10:09.388795Z"}]}}