CVE-2024-54880
Published: 06 January 2025
Summary
CVE-2024-54880 is a critical-severity Improper Preservation of Permissions (CWE-281) vulnerability in Seacms Seacms. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Create Account (T1136); ranked in the top 9.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
AC-2 establishes procedures for account creation, approval, and management, directly preventing unauthorized bulk account registrations exploiting the logic flaw.
AC-3 enforces approved access control policies, comprehensively addressing the incorrect access control that permits bulk registrations by any user.
AC-6 applies least privilege to security functions like account creation, limiting the ability of unauthenticated users to perform bulk registrations.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability directly bypasses registration controls enabling bulk account creation (T1136) on a public-facing web app (T1190).
NVD Description
SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to register accounts in bulk.
Deeper analysisAI
CVE-2024-54880 is an Incorrect Access Control vulnerability (CWE-281) affecting SeaCMS version 13.1. The issue stems from a logic flaw that permits any user to register accounts in bulk, bypassing intended restrictions. Published on 2025-01-06, it carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), highlighting its critical severity due to high impacts on confidentiality and integrity.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation enables bulk account creation, potentially allowing adversaries to overwhelm the system with fraudulent registrations and achieve significant unauthorized access or control.
Mitigation details can be found in advisories referenced at https://blog.csdn.net/weixin_46686336/article/details/144797063 and the vendor site https://www.seacms.net/.
Details
- CWE(s)