CVE-2024-54002

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significantly longer than performing the same action with a username that is not known by the system. The observable difference in request duration can be leveraged by actors to enumerate valid names of managed users. LDAP and OpenID Connect users are not affected. The issue has been fixed in Dependency-Track 4.12.2.

• CWE-203

• https://github.com/DependencyTrack/dependency-track/security/advisories/GHSA-9w3m-hm36-w32w

Published

Dec 4, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-53995SickChill is an automatic video library manager for TV shows…1.9
• CVE-2024-53996Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-53999Mobile Security Framework (MobSF) is a pen-testing, malware …5.4
• CVE-2024-5400Openfind Mail2000 does not properly filter parameters of spe…8.8
• CVE-2024-54000Mobile Security Framework (MobSF) is a pen-testing, malware …7.5
• CVE-2024-54001Kanboard is project management software that focuses on the …5.5
• CVE-2024-54003Jenkins Simple Queue Plugin 1.4.4 and earlier does not escap…8
• CVE-2024-54004Jenkins Filesystem List Parameter Plugin 0.0.14 and earlier …4.3
• CVE-2024-54005A vulnerability has been identified in COMOS V10.3 (All vers…5.9
• CVE-2024-54006Multiple command injection vulnerabilities exist in the web …7.2
• CVE-2024-54007Multiple command injection vulnerabilities exist in the web …7.2
• CVE-2024-54008An authenticated Remote Code Execution (RCE) vulnerability e…7.2