CVE-2024-38371

Katalog CVE

CVSS 9.8 · Critical EPSS 0,58%

Kerentanan Improper Access Control pada goauthentik authentik. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when using the OAuth2 Device code flow. This could potentially allow users without the correct authorization to get OAuth tokens for an application and access it. This issue has been patched in version(s) 2024.6.0, 2024.2.4 and 2024.4.3.

Rincian

Terbit di NVD

28 Juni 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-285: Improper Authorization

EPSS (30 hari)

0,58% peluang dieksploitasi; lebih tinggi dari 46,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/goauthentik/authentik/security/advisories/GHSA-jq3m-37m7-gp45 mitigasi · advisory vendor
• https://github.com/goauthentik/authentik/releases/tag/version%2F2024.2.4 release notes
• https://github.com/goauthentik/authentik/releases/tag/version%2F2024.4.3 release notes
• https://github.com/goauthentik/authentik/releases/tag/version%2F2024.6.0 release notes