CVE-2024-6592

Katalog CVE

CVSS 9.1 · Critical EPSS 1,2%

Kerentanan Missing Authentication for Critical Function pada watchguard authentication gateway, watchguard single sign-on client. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows an attacker with network access to forge communications to affected components. In the event an attacker has already gained network access, they could exploit this vulnerability to retrieve authenticated usernames and group memberships from the Single Sign-On Agent or send arbitrary account and group information to the Single Sign-On Agent for their host. This vulnerability cannot be used by an attacker to gain access to user credentials.

Rincian

Terbit di NVD

25 September 2024

Terakhir diubah

8 Agustus 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function
CWE-863: Incorrect Authorization

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00014 mitigasi · advisory vendor
• https://psirt.watchguard.com/CVE-2024-6592
• https://www.redteam-pentesting.de/advisories/rt-sa-2024-006