Lucene search

CyberDanubeVULNRICHMENT:CVE-2024-42164

HistoryAug 12, 2024 - 11:27 a.m.

CVE-2024-42164 Disabling MFA without Authentication

2024-08-1211:27:17

CWE-287

CyberDanube

github.com

cve

fiware keyrock

mfa

vulnerability

password reset

token

authentication

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

7.1

Confidence

High

EPSS

Percentile

14.7%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to disable two factor authorization of any user by predicting the token for the disable_2fa link.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "FIWARE Keyrock",
    "vendor": "FIWARE",
    "versions": [
      {
        "lessThanOrEqual": "8.4",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.ait.ac.at/themen/cyber-security/pentesting/security-advisories

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

7.1

Confidence

High

EPSS

Percentile

14.7%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-42164