CVE-2024-37905

June 28, 2024, 6:15 p.m.

8.8
High

Description

authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin user privileges. A successful exploit of the issue will result in a user gaining full admin access to the Authentik application, including resetting user passwords and more. This issue has been patched in version(s) 2024.2.4, 2024.4.2 and 2024.6.0.

Product(s) Impacted

Product Versions
authentik
  • 2014.2.4
  • 2014.4.2
  • 2014.6.0

Weaknesses

CWE-284
Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References

https://github.com/goauthentik/authentik/releases/tag/version%2F2024.2.4
https://github.com/goauthentik/authentik/releases/tag/version%2F2024.4.3
https://github.com/goauthentik/authentik/releases/tag/version%2F2024.6.0
https://github.com/goauthentik/authentik/security/advisories/GHSA-c78c-2r9w-p7x4

Tags

CWE-284
security-advisories@github.com
2024-06-28
CVE-2024-37905

CVSS Score

8.8 / 10

CVSS Data

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: LOW
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH
    • View Vector String

    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Date

  • Published: June 28, 2024, 6:15 p.m.
  • Last Modified: June 28, 2024, 6:15 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security-advisories@github.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.