Cyber Resilience

CVE-2024-54880

CriticalPublic PoC

Published: 06 January 2025

Published
06 January 2025
Modified
28 March 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0731 91.9th percentile
Risk Priority 23 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-54880 is a critical-severity Improper Preservation of Permissions (CWE-281) vulnerability in Seacms Seacms. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Create Account (T1136); ranked in the top 8.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-3 (Access Enforcement).

Deeper analysis

SeaCMS V13.1 is affected by an incorrect access control vulnerability tracked as CVE-2024-54880 and CWE-281. The flaw arises from a logic error in the registration process that fails to enforce proper restrictions, allowing bulk account creation without authentication.

Unauthenticated remote attackers can exploit the issue over the network with low complexity to register arbitrary numbers of accounts, resulting in high confidentiality and integrity impacts according to the CVSS 9.1 rating. The EPSS score has remained flat at 0.0731 with no indicated rise after disclosure. No mitigation details or patch information appear in the supplied references.

EU & UK References

Vulnerability details

SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to register accounts in bulk.

CWE(s)
CWE-281

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1136 Create Account Persistence
Adversaries may create an account to maintain access to victim systems.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Vulnerability directly bypasses registration controls enabling bulk account creation (T1136) on a public-facing web app (T1190).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-54879Same product: Seacms Seacms
CVE-2025-22974Same product: Seacms Seacms
CVE-2025-25519Same product: Seacms Seacms
CVE-2025-25521Same product: Seacms Seacms
CVE-2025-25516Same product: Seacms Seacms
CVE-2025-25517Same product: Seacms Seacms
CVE-2025-25520Same product: Seacms Seacms
CVE-2025-25513Same product: Seacms Seacms
CVE-2025-25515Same product: Seacms Seacms
CVE-2024-56973Shared CWE-281

Affected Assets

seacms
seacms
13.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-2 Account Management good match
prevent

AC-2 establishes procedures for account creation, approval, and management, directly preventing unauthorized bulk account registrations exploiting the logic flaw.

AC-3 Access Enforcement good match
prevent

AC-3 enforces approved access control policies, comprehensively addressing the incorrect access control that permits bulk registrations by any user.

AC-6 Least Privilege partial match
prevent

AC-6 applies least privilege to security functions like account creation, limiting the ability of unauthenticated users to perform bulk registrations.

References