CVE-2024-39891

Katalog CVE

CVSS 5.3 · Medium KEV · sudah dieksploitasi EPSS 1,7%

Kerentanan Observable Discrepancy pada twilio authy, twilio authy authenticator. Skor CVSS 3.1 5.3 (Medium) menurut NVD. Masuk katalog KEV CISA pada 23 Juli 2024, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. Specifically, the endpoint accepted a stream of requests containing phone numbers, and responded with information about whether each phone number was registered with Authy. (Authy accounts were not compromised, however.)

Rincian

Terbit di NVD

2 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-203: Observable Discrepancy

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,1% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Twilio Authy Information Disclosure Vulnerability

Masuk KEV

23 Juli 2024

Tenggat CISA

13 Agustus 2024 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-39891 pemerintah AS
• https://cwe.mitre.org/data/definitions/203.html deskripsi teknis
• https://www.bleepingcomputer.com/news/security/hackers-abused-api-to-verify-millions-of-authy-mfa-phone-number... press/media coverage
• https://www.twilio.com/docs/usage/security/reporting-vulnerabilities product
• https://www.twilio.com/en-us/changelog release notes