Lucene search

[email protected]NVD:CVE-2024-45788

HistorySep 11, 2024 - 12:15 p.m.

CVE-2024-45788

2024-09-1112:15:02

CWE-799

[email protected]

web.nvd.nist.gov

reedos aim-star

otp bombing

vulnerability

api endpoints

rate limiting

cve-2024-45788

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

17.8%

JSON

This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing rate limiting on OTP requests in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoints which could lead to the OTP bombing/flooding on the targeted system.

Affected configurations

Nvd

Node

reedosaim-starMatch2.0.1

VendorProductVersionCPE
reedosaim-star2.0.1cpe:2.3:a:reedos:aim-star:2.0.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
reedos	aim-star	2.0.1	cpe:2.3:a:reedos:aim-star:2.0.1:::::::*

References

www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0291

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

17.8%

JSON

Related for NVD:CVE-2024-45788

cvelist1 cve1 vulnrichment1