CVE-2024-5716
Last modified
CVE-2024-5716 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Logsign Unified SecOps Platform Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Logsign Unified SecOps Platform. EPSS estimates a 1.60% chance of exploitation in the next 30 days.
Description
Logsign Unified SecOps Platform Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability. The specific flaw exists within the password reset mechanism. The issue results from the lack of restriction of excessive authentication attempts. An attacker can leverage this vulnerability to reset a user's password and bypass authentication on the system. Was ZDI-CAN-24164.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Logsign | Unified Secops Platform | >= 6.4.6, < 6.4.8 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-5716?
How severe is CVE-2024-5716?
How do I fix CVE-2024-5716?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-57151SQL Injection vulnerability in rainrocka xinhu v.2.6.5 and b…6.8
- CVE-2024-57152Incorrect access control in the preHandle function of my-sit…7.5
- CVE-2024-57154Incorrect access control in dts-shop v0.0.1-SNAPSHOT allows …9.8
- CVE-2024-57155Incorrect access control in radar v1.0.8 allows attackers to…9.8
- CVE-2024-57157Incorrect access control in Jantent v1.1 allows attackers to…9.8
- CVE-2024-5715907FLYCMS V1.3.9 was discovered to contain a Cross-Site Reque…3.5
- CVE-2024-5716007FLYCMS V1.3.9 was discovered to contain a Cross-Site Reque…4.3
- CVE-2024-5716107FLYCMS V1.3.9 was discovered to contain a Cross-Site Reque…4.3
- CVE-2024-57162Campcodes Cybercafe Management System v1.0 is vulnerable to …7.2
- CVE-2024-57169A file upload bypass vulnerability exists in SOPlanning 1.53…9.8
- CVE-2024-5717Logsign Unified SecOps Platform Command Injection Remote Cod…8.8
- CVE-2024-57170SOPlanning 1.53.00 is vulnerable to a directory traversal is…6.5
Are you affected by CVE-2024-5716?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST