CVE-2024-4332
Last modified
CVE-2024-4332 is a critical-severity vulnerability rated 9.3/10 on the CVSS scale. An authentication bypass vulnerability has been identified in the REST and SOAP API components of Tripwire Enterprise (TE) 9.1.0 when TE is configured to use LDAP/Active Directory SAML authentication and its optional "Auto-synchronize LDAP Users, Roles, and Groups" feature is enabled. This vulnerability allows unauthenticated attackers to bypass authentication if a valid username is known. EPSS estimates a 0.64% chance of exploitation in the next 30 days.
Description
An authentication bypass vulnerability has been identified in the REST and SOAP API components of Tripwire Enterprise (TE) 9.1.0 when TE is configured to use LDAP/Active Directory SAML authentication and its optional "Auto-synchronize LDAP Users, Roles, and Groups" feature is enabled. This vulnerability allows unauthenticated attackers to bypass authentication if a valid username is known. Exploitation of this vulnerability could allow remote attackers to gain privileged access to the APIs and lead to unauthorized information disclosure or modification.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Red
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-4332?
How severe is CVE-2024-4332?
How do I fix CVE-2024-4332?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-43314Missing Authorization vulnerability in Gabe Livan Asset Clea…8.8
- CVE-2024-43315Authorization Bypass Through User-Controlled Key vulnerabili…7.5
- CVE-2024-43316Cross-Site Request Forgery (CSRF) vulnerability in Checkout …4.3
- CVE-2024-43317Improper Neutralization of Input During Web Page Generation …6.1
- CVE-2024-43318Improper Neutralization of Input During Web Page Generation …5.4
- CVE-2024-43319Exposure of Sensitive Information to an Unauthorized Actor v…4.3
- CVE-2024-43320Improper Neutralization of Input During Web Page Generation …6.5
- CVE-2024-43321Improper Neutralization of Input During Web Page Generation …6.5
- CVE-2024-43322Authorization Bypass Through User-Controlled Key vulnerabili…9.8
- CVE-2024-43323Missing Authorization vulnerability in ReviewX ReviewX allow…9.8
- CVE-2024-43324Improper Neutralization of Input During Web Page Generation …4.8
- CVE-2024-43325Cross-Site Request Forgery (CSRF) vulnerability in Naiche Da…8.8
Are you affected by CVE-2024-4332?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST