Products
RapidIdentity
- LTS through 2023.0.2
- Cloud through 2024.08.0
Source
cve@mitre.org
Tags
CVE-2024-45589 details
Published : Sept. 5, 2024, 4:15 p.m.
Last Modified : Sept. 5, 2024, 6:35 p.m.
Last Modified : Sept. 5, 2024, 6:35 p.m.
Description
RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts and allows a remote attacker to cause a denial of service via the username parameters.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6.5 | 7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks. |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Base Score
6.5
Exploitability Score
2.8
Impact Score
3.6
Base Severity
MEDIUM
Vector String : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
| URL | Source |
|---|---|
| https://benrogozinski.github.io/CVE-2024-45589/ | cve@mitre.org |
| https://help.rapididentity.com/docs/rapididentity-lts-release-notes | cve@mitre.org |
This website uses the NVD API, but is not approved or certified by it.