ZDI-24-111: Allegra Hard-coded Credentials Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of a database. The issue results from the use of a hardcoded password. An attacker can leverage this vulnerability to bypass authentication on the system.
Other sources
This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2023-22360.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-24-111?
The severity of ZDI-24-111 is classified as critical due to its ability to allow remote attackers to bypass authentication.
How do I fix ZDI-24-111?
To fix ZDI-24-111, ensure all hardcoded passwords in the database configuration are replaced with secure, randomized values.
Which installations are affected by ZDI-24-111?
ZDI-24-111 affects various installations of Allegra that have not resolved the hardcoded password configuration issue.
Can ZDI-24-111 be exploited without authentication?
Yes, ZDI-24-111 can be exploited without authentication, making it particularly dangerous for affected systems.
What are the potential impacts of ZDI-24-111?
The potential impacts of ZDI-24-111 include unauthorized access to sensitive data and system control for attackers.