fkie_cve-2024-12839
Vulnerability from fkie_nvd
Published
2024-12-31 02:15
Modified
2024-12-31 02:15
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
The login mechanism via device authentication of CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability. If a user visits a forged website, the agent program deployed on their device will send an authentication signature to the website. An unauthenticated remote attacker who obtains this signature can use it to log into the system with any device.
References
twcert@cert.org.twhttps://www.twcert.org.tw/en/cp-139-8335-e4a3f-2.html
twcert@cert.org.twhttps://www.twcert.org.tw/tw/cp-132-8334-8b836-1.html
Impacted products
Vendor Product Version


To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The login mechanism via device authentication of CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability. If a user visits a forged website, the agent program deployed on their device will send an authentication signature to the website. An unauthenticated remote attacker who obtains this signature can use it to log into the system with any device."
    },
    {
      "lang": "es",
      "value": "El mecanismo de inicio de sesi\u00f3n mediante autenticaci\u00f3n de dispositivo de CGFIDO de Changing Information Technology tiene una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n. Si un usuario visita un sitio web falsificado, el programa agente implementado en su dispositivo enviar\u00e1 una firma de autenticaci\u00f3n al sitio web. Un atacante remoto no autenticado que obtenga esta firma puede usarla para iniciar sesi\u00f3n en el sistema con cualquier dispositivo."
    }
  ],
  "id": "CVE-2024-12839",
  "lastModified": "2024-12-31T02:15:06.110",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "twcert@cert.org.tw",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-12-31T02:15:06.110",
  "references": [
    {
      "source": "twcert@cert.org.tw",
      "url": "https://www.twcert.org.tw/en/cp-139-8335-e4a3f-2.html"
    },
    {
      "source": "twcert@cert.org.tw",
      "url": "https://www.twcert.org.tw/tw/cp-132-8334-8b836-1.html"
    }
  ],
  "sourceIdentifier": "twcert@cert.org.tw",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-294"
        }
      ],
      "source": "twcert@cert.org.tw",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.