CVE-2024-42164

Insufficiently random values for generating password reset token in FIWARE Keyrock <= 8.4 allow attackers to disable two factor authorization of any user by predicting the token for the disable_2fa link.
References
Configurations

Configuration 1 (hide)

cpe:2.3:a:fiware:keyrock:*:*:*:*:*:*:*:*

History

29 Aug 2024, 15:19

Type Values Removed Values Added
CPE cpe:2.3:a:fiware:keyrock:*:*:*:*:*:*:*:*
CWE CWE-330
References () https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories - () https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories - Exploit, Third Party Advisory
First Time Fiware
Fiware keyrock
Summary
  • (es) Los valores insuficientemente aleatorios para generar el token de restablecimiento de contraseña en FIWARE Keyrock &lt;= 8.4 permiten a los atacantes desactivar la autorización de dos factores de cualquier usuario al predecir el token para el enlace enable_2fa.

12 Aug 2024, 13:41

Type Values Removed Values Added
New CVE

Information

Published : 2024-08-12 13:38

Updated : 2024-08-29 15:19


NVD link : CVE-2024-42164

Mitre link : CVE-2024-42164

CVE.ORG link : CVE-2024-42164


JSON object : View

Products Affected

fiware

  • keyrock
CWE
CWE-330

Use of Insufficiently Random Values

CWE-287

Improper Authentication