PT-2023-27351 · Empowerid · Empowerid

Nirav Patel · Published 2023-08-11 · Updated 2023-09-20 · CVE-2023-40260

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions EmpowerID versions prior to 7.205.0.1

Description The issue allows an attacker to bypass a multi-factor authentication (MFA) requirement if the first factor, which includes the username and password, is known. This is possible because knowing the first factor is sufficient to change an account's email address. Once the email address is changed, the product sends MFA codes to the new email address, which may be controlled by the attacker.

Recommendations For EmpowerID versions prior to 7.205.0.1, update to version 7.205.0.1 or later to resolve the issue. As a temporary workaround, consider restricting the ability to change email addresses for accounts to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-40260

Affected Products

Empowerid

References · 6

• https://osv.dev/vulnerability/CVE-2023-40260 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40260 · Security Note
• https://twitter.com/CVEnew/status/1690557143311622144 · Twitter Post
• https://t.me/cibsecurity/68329 · Telegram Post
• https://seclists.org/fulldisclosure/2023/Aug/3 · Note
• https://t.me/cvenotify/56246 · Telegram Post