Lucene search

Veracode Vulnerability DatabaseVERACODE:46693

HistoryApr 30, 2024 - 8:15 a.m.

Authentication Bypass By Capture-replay

2024-04-3008:15:41

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

authentication

bypass

capture-replay

vulnerability

linotp

software

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

6.7 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

66.3%

JSON

LinOTP is vulnerable to Authentication Bypass By Capture-replay. The vulnerability is due to the activation of automatic resynchronization, allowing an attacker to successfully log in with OTP values recorded at a previous point in time.

CPENameOperatorVersion
linotple2.10.0.1
linotple2.10.0.1

CPE	Name	Operator	Version
	linotp	le	2.10.0.1
	linotp	le	2.10.0.1

References

github.com/advisories/GHSA-rqg8-xjp2-pg9w

github.com/LinOTP/LinOTP/commit/6d28d93af59d2ce0d844a6a3282148064efc6ad8

www.linotp.org/CVE-2019-12887.txt

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

6.7 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

66.3%

JSON

Related for VERACODE:46693