Received
CVE has been recently published to the CVE List and has been received by the NVD.

Products

WatchGuard Authentication Gateway

through 12.10.2

WatchGuard Single Sign-On Client for Windows

through 12.7

WatchGuard Single Sign-On Client for MacOS

through 12.5.4

Source

5d1c2695-1a31-4499-88ae-e847036fd7e3

CVE-2024-6592 details

Published : Sept. 25, 2024, 12:15 p.m.
Last Modified : Sept. 25, 2024, 12:15 p.m.

Description

Incorrect Authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows Authentication Bypass.This issue affects the Authentication Gateway: through 12.10.2; Windows Single Sign-On Client: through 12.7; MacOS Single Sign-On Client: through 12.5.4.

CVSS Score

1	2	3	4	5	6	7	8	9.1	10

Weakness

Weakness	Name	Description
CWE-863	Incorrect Authorization	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

Base Score

9.1

Exploitability Score

3.9

Impact Score

5.2

Base Severity

CRITICAL

Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

URL	Source
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00014	5d1c2695-1a31-4499-88ae-e847036fd7e3

This website uses the NVD API, but is not approved or certified by it.

CVE-2024-6592