Lucene search

CyberDanubeCVE-2024-42163

HistoryAug 12, 2024 - 1:38 p.m.

CVE-2024-42163

2024-08-1213:38:32

CWE-326

CyberDanube

web.nvd.nist.gov

cve

fiware keyrock

password reset

CVSS3

8.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

AI Score

8.4

Confidence

High

EPSS

0.001

Percentile

20.1%

JSON

Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to take over the account of any user by predicting the token for the password reset link.

Affected configurations

Nvd

Node

fiwarekeyrockRange≤8.4

VendorProductVersionCPE
fiwarekeyrock*cpe:2.3:a:fiware:keyrock:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
fiware	keyrock	*	cpe:2.3:a:fiware:keyrock::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "FIWARE Keyrock",
    "vendor": "FIWARE",
    "versions": [
      {
        "lessThanOrEqual": "8.4",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.ait.ac.at/themen/cyber-security/pentesting/security-advisories

CVSS3

8.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

AI Score

8.4

Confidence

High

EPSS

0.001

Percentile

20.1%

JSON

Related for CVE-2024-42163