CVE-2024-46937

2024-09-1600:00:00

mitre

github.com

mfasoft secure authentication server

vulnerability

get-info-token-properties

improper access control

remote attackers

token access

authentication

brute-force attack

serial parameter

number identifier

AI Score

7.1

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

An improper access control (IDOR) vulnerability in the /api-selfportal/get-info-token-properties endpoint in MFASOFT Secure Authentication Server (SAS) 1.8.x through 1.9.x before 1.9.040924 allows remote attackers gain access to user tokens without authentication. The is a brute-force attack on the serial parameter by number identifier: GA00001, GA00002, GA00003, etc.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:mfasoft:secure_authentication_server:*:*:*:*:*:*:*:*"
    ],
    "vendor": "mfasoft",
    "product": "secure_authentication_server",
    "versions": [
      {
        "status": "affected",
        "version": "1.8.x",
        "lessThan": "1.9.040924",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]