Unauthenticated Remote Attackers Can Reset Any User's Password

CVE-2024-3777

What is CVE-2024-3777?

The vulnerability in Ai3 QbiBot's password reset functionality arises from a lack of adequate access controls, enabling malicious actors to reset the passwords of any user without authentication. This significant security oversight poses a serious threat, as it grants unauthorized access to user accounts, potentially leading to further exploitation of personal or sensitive information. Organizations using Ai3 QbiBot should prioritize reviewing their implementations and applying necessary mitigations to safeguard their systems and user data.

References