Security readout for executives and security teams
Plain-English summary
CVE-2023-24688 is a registration-control bypass in mojoPortal v2.7.0.0. An unauthenticated person may be able to create a new user account even when administrators disabled user registrations. The direct impact is unauthorized account creation, not proven data theft or service outage.
Executive priority
Treat as a moderate-priority governance issue. It does not indicate confirmed compromise, but public sites using disabled registration as a control should validate quickly and tighten account monitoring until vendor guidance is confirmed.
Technical view
The CVE describes improper access control, CWE-284, allowing unauthenticated registration despite the Allow User Registrations setting being disabled. CVSS 3.1 is 5.3 with network access, low complexity, no privileges, no user interaction, and low integrity impact only.
Likely exposure
Exposure is most relevant to internet-facing mojoPortal v2.7.0.0 sites that rely on disabled registration to prevent new accounts. The structured affected-product fields are incomplete, so teams should verify deployed versions and configuration directly.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The issue is still operationally meaningful because account creation can undermine access governance and may enable later misuse depending on site permissions.
Researcher notes
Evidence is limited to the CVE description and referenced advisory. No patch, exploit status, or affected CPE range is provided in the bundle. Avoid expanding impact beyond unauthorized registration unless local role defaults create additional exposure.
Mitigation direction
- Check mojoPortal vendor or project guidance for fixed versions or configuration advice.
- Inventory mojoPortal deployments and identify any running v2.7.0.0.
- Restrict public access to registration workflows where business requirements allow.
- Review account approval, role assignment, and default-permission settings.
- Monitor and remove unexpected newly created accounts.
Validation and detection
- Confirm whether the site is running mojoPortal v2.7.0.0.
- Verify whether user registration is intended to be disabled.
- Review user account creation logs around and after exposure windows.
- Check for unexpected accounts, roles, or permission changes.
- Document whether vendor guidance identifies a fixed release.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-24688 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N3.91.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.mojoportal.com/CVE reference
- https://github.com/blakduk/Advisories/blob/main/Mojoportal/README.mdCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.