In VeridiumID before 3.5.0, the WebAuthn API allows an internal unauthenticated attacker (who can pass enrollment verifications and is allowed to enroll a FIDO key) to register their FIDO authenticator to a victim’s account and consequently take over the account.
References
Configurations
No configuration.
History
21 Aug 2024, 21:35
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-287 | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
Summary |
|
03 Apr 2024, 16:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-04-03 16:15
Updated : 2024-08-21 21:35
NVD link : CVE-2023-44039
Mitre link : CVE-2023-44039
CVE.ORG link : CVE-2023-44039
JSON object : View
Products Affected
No product.
CWE
CWE-287
Improper Authentication