Lucene search

N-ableVULNRICHMENT:CVE-2024-5322

HistoryJul 01, 2024 - 8:46 p.m.

CVE-2024-5322 N-central Authentication Bypass via Session Rebinding

2024-07-0120:46:40

CWE-288

N-able

github.com

n-central

authentication bypass

session rebinding

entra sso

vulnerability

authentication

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

7.1 High

AI Score

Confidence

Low

JSON

The N-central server is vulnerable to session rebinding of already authenticated users when using Entra SSO, which can lead to authentication bypass.

This vulnerability is present in all Entra-supported deployments of N-central prior to 2024.3.

CNA Affected

[
  {
    "vendor": "N-able",
    "product": "N-central",
    "versions": [
      {
        "status": "affected",
        "version": "<2024.3",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

documentation.n-able.com/N-central/Release_Notes/GA/Content/2024.3%20Release%20Notes.htm

me.n-able.com/s/security-advisory/aArVy0000000BgDKAU/cve20245322-ncentral-authentication-bypass-via-session-rebinding

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

7.1 High

AI Score

Confidence

Low

JSON

Related for VULNRICHMENT:CVE-2024-5322