GitHub_MCVE-2024-21637CVE-2024-21637
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
EPSS
Percentile
27.4%
Authentik is an open-source Identity Provider. Authentik is a vulnerable to a reflected Cross-Site Scripting vulnerability via JavaScript-URIs in OpenID Connect flows with response_mode=form_post. This relatively user could use the described attacks to perform a privilege escalation. This vulnerability has been patched in versions 2023.10.6 and 2023.8.6.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| goauthentik | authentik | * | cpe:2.3:a:goauthentik:authentik:*:*:*:*:*:*:*:* |
CNA Affected
[
{
"vendor": "goauthentik",
"product": "authentik",
"versions": [
{
"version": "<= 2023.10.5",
"status": "affected"
},
{
"version": "<= 2023.8.5",
"status": "affected"
}
]
}
]Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
EPSS
Percentile
27.4%