PT-2023-27351 · Empowerid · Empowerid

Nirav Patel · Publicado 2023-08-11 · Atualizado 2023-09-20 · CVE-2023-40260

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions EmpowerID versions prior to 7.205.0.1

Description The issue allows an attacker to bypass a multi-factor authentication (MFA) requirement if the first factor, which includes the username and password, is known. This is possible because knowing the first factor is sufficient to change an account's email address. Once the email address is changed, the product sends MFA codes to the new email address, which may be controlled by the attacker.

Recommendations For EmpowerID versions prior to 7.205.0.1, update to version 7.205.0.1 or later to resolve the issue. As a temporary workaround, consider restricting the ability to change email addresses for accounts to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2023-40260

Produtos afetados

Empowerid

Referências · 6

• https://twitter.com/CVEnew/status/1690557143311622144 · Publicação no Twitter
• https://t.me/cibsecurity/68329 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-40260 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-40260 · Nota de Segurança
• https://seclists.org/fulldisclosure/2023/Aug/3 · Nota
• https://t.me/cvenotify/56246 · Publicação no Telegram