Lucene search

K
cisa_kevCISACISA-KEV-CVE-2024-39891
HistoryJul 23, 2024 - 12:00 a.m.

Twilio Authy Information Disclosure Vulnerability

2024-07-2300:00:00
CISA
www.cisa.gov
67
twilio
authy
api
information disclosure
vulnerability
unauthenticated endpoint
phone number

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

6.6

Confidence

Low

EPSS

0.118

Percentile

95.4%

Twilio Authy contains an information disclosure vulnerability in its API that allows an unauthenticated endpoint to accept a request containing a phone number and respond with information about whether the phone number was registered with Authy.

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

6.6

Confidence

Low

EPSS

0.118

Percentile

95.4%

Related for CISA-KEV-CVE-2024-39891