CVE-2024-52287

Katalog CVE

CVSS 7.2 · High EPSS 0,58%

Kerentanan Improper Authorization pada goauthentik authentik. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

authentik is an open-source identity provider. When using the client_credentials or device_code OAuth grants, it was possible for an attacker to get a token from authentik with scopes that haven't been configured in authentik. authentik 2024.8.5 and 2024.10.3 fix this issue.

Rincian

Terbit di NVD

21 November 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization

EPSS (30 hari)

0,58% peluang dieksploitasi; lebih tinggi dari 46,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/goauthentik/authentik/security/advisories/GHSA-v6m7-8j37-8f4v advisory vendor
• https://github.com/goauthentik/authentik/commit/e9c29e1644e9199b4ba58d2b10eb8c322138eea2 patch