Lucene search
GoogleOSV:GHSA-6WHF-Q6P5-84WGHistorySep 29, 2021 - 5:16 p.m.
Improper Access Control in Webauthn Framework
2021-09-2917:16:07
Google
osv.dev
11
0.003 Low
EPSS
Percentile
71.1%
Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user’s system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence.
References
github.com/web-auth/webauthn-framework
github.com/web-auth/webauthn-framework/commit/572e239c5702667ca52487faf861abc768a46308
github.com/web-auth/webauthn-framework/releases
github.com/web-auth/webauthn-framework/releases/tag/v3.3.4
nvd.nist.gov/vuln/detail/CVE-2021-38299
www.fzi.de/en/news/news/detail-en/artikel/fsa-2021-1-fehlende-ueberpruefung-von-user-presence-in-webauthn-framework
Related
prion
prion
Design/Logic Flaw
2021-09-27 06:15:00
osv
osv
CVE-2021-38299
2021-09-27 06:15:07
cvelist
cvelist
CVE-2021-38299
2021-09-27 05:55:51
veracode
veracode
Insecure Access Control
2021-09-28 05:08:52
nextcloud
nextcloud
Missing User Presence Check in Nextcloud WebAuthn login
2021-10-25 11:02:44
cve
cve
CVE-2021-38299
2021-09-27 06:15:07
nvd
nvd
CVE-2021-38299
2021-09-27 06:15:07
github
github
Improper Access Control in Webauthn Framework
2021-09-29 17:16:07