Lucene search

CERT-InVULNRICHMENT:CVE-2024-47086

HistorySep 19, 2024 - 6:03 a.m.

CVE-2024-47086 OTP Bypass Vulnerability

2024-09-1906:03:10

CWE-302

CERT-In

github.com

cve-2024-47086

apex softcell

otp bypass

CVSS4

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

7.4

Confidence

Low

EPSS

0.001

Percentile

18.8%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

This vulnerability exists in Apex Softcell LD DP Back Office due to improper implementation of OTP validation mechanism in certain API endpoints. An authenticated remote attacker could exploit this vulnerability by providing arbitrary OTP value for authentication and subsequently changing its API response.

Successful exploitation of this vulnerability could allow the attacker to bypass OTP verification for other user accounts.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:apexsoftcell:ld_dp_back_office:*:*:*:*:*:*:*:*"
    ],
    "vendor": "apexsoftcell",
    "product": "ld_dp_back_office",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "24.8.21.1",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0296

CVSS4

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:N/SI:N/VA:N/SA:N

AI Score

7.4

Confidence

Low

EPSS

0.001

Percentile

18.8%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-47086