CVE-2024-48533: n/a
Source CVE Database V5
Not known to be exploited · CVSS 5.3 Medium.
Data as of 26 Oct 2026, 07:57 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 34% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 20 Nov 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
AI-suggested
To mitigate CVE-2024-48533, organizations should implement the following specific measures: 1) Modify the Forgot your Login? module to provide uniform responses regardless of whether the submitted email address is valid or invalid, thereby preventing attackers from distinguishing valid accounts. 2) Implement rate limiting and IP throttling on the login recovery endpoint to reduce the feasibility of automated enumeration attacks. 3) Monitor logs for unusual patterns of password reset or login recovery requests that may indicate enumeration attempts. 4) Educate users about phishing risks and encourage the use of multi-factor authentication (MFA) to reduce the impact of compromised credentials. 5) Engage with the vendor to obtain patches or updates as soon as they become available. 6) Consider deploying web application firewalls (WAFs) with rules designed to detect and block enumeration behaviors targeting the affected module. 7) Review and tighten access controls and authentication mechanisms around user account management features. These targeted actions go beyond generic advice and address the specific nature of this vulnerability.
Description
A discrepancy between responses for valid and invalid e-mail accounts in the Forgot your Login? module of eSoft Planner 3.24.08271-USA allows attackers to enumerate valid user e-mail accounts.