CVE-2024-47654

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

This vulnerability exists in Shilpi Client Dashboard due to lack of rate limiting and Captcha protection for OTP requests in certain API endpoint. An unauthenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoints, which could lead to the OTP bombing on the targeted system.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-799

Affected software

No affected versions have been published.

Timeline

Published
Oct 4, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-476558.8This vulnerability exists in the Shilpi Client Dashboard due to improper validation of files being uploaded other than the specified extensiCVE-2024-476569.8This vulnerability exists in Shilpi Client Dashboard due to missing restrictions for incorrect login attempts on its API based login. A remoCVE-2024-476576.5This vulnerability exists in the Shilpi Net Back Office due to improper access controls on certain API endpoints. An authenticated remote atCVE-2024-476585.5In the Linux kernel, the following vulnerability has been resolved: crypto: stm32/cryp - call finalize with bh disabled The finalize operaCVE-2024-476598.8In the Linux kernel, the following vulnerability has been resolved: smack: tcp: ipv4, fix incorrect labeling Currently, Smack mirrors the CVE-2024-47664.3Different techniques existed to obscure the fullscreen notification in Firefox for Android. These could have led to potential user confusioCVE-2024-476604.7In the Linux kernel, the following vulnerability has been resolved: fsnotify: clear PARENT_WATCHED flags lazily In some setups directoriesCVE-2024-476615.5In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid overflow from uint32_t to uint8_t [WHAT & HOW] CVE-2024-476625.5In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove register from DCN35 DMCUB diagnostic collectionCVE-2024-476635.5In the Linux kernel, the following vulnerability has been resolved: staging: iio: frequency: ad9834: Validate frequency parameter value InCVE-2024-476645.5In the Linux kernel, the following vulnerability has been resolved: spi: hisi-kunpeng: Add verification for the max_frequency provided by tCVE-2024-476655.5In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup Defi
CVE-2024-47654: High severity, CVSS 7.5 | Vulnix