CVE-2024-4332

Katalog CVE

CVSS 9.3 · Critical EPSS 0,64%

Kerentanan Incorrect Implementation of Authentication Algorithm. Skor CVSS 4.0 9.3 (Critical) menurut CNA.

Deskripsi (NVD)

An authentication bypass vulnerability has been identified in the REST and SOAP API components of Tripwire Enterprise (TE) 9.1.0 when TE is configured to use LDAP/Active Directory SAML authentication and its optional "Auto-synchronize LDAP Users, Roles, and Groups" feature is enabled. This vulnerability allows unauthenticated attackers to bypass authentication if a valid username is known. Exploitation of this vulnerability could allow remote attackers to gain privileged access to the APIs and lead to unauthorized information disclosure or modification.

Rincian

Terbit di NVD

3 Juni 2024

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 4.0

9.3 (Critical), sumber CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Red · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-303: Incorrect Implementation of Authentication Algorithm
CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://www.fortra.com/security/advisory/fi-2024-006