PT-2023-31305 · Linotp · Linotp

Published 2023-12-19 · Updated 2023-12-28 · CVE-2023-49706

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions LinOTP versions 3.x before 3.2.5

Description Defective request context handling in Self Service allows remote unauthenticated attackers to escalate privileges, thereby allowing them to act as and with the permissions of another user. Attackers must generate repeated API requests to trigger a race condition with concurrent user activity in the self-service portal.

Recommendations For versions prior to 3.2.5, update to version 3.2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the self-service portal to minimize the risk of exploitation.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2023-49706

Affected Products

Linotp

References · 7

• https://linotp.org/CVE-2023-49706.txt · Vendor Advisory
• https://linotp.org/news.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49706 · Security Note
• https://linotp.org/security-update-linotp3-selfservice.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49706 · Vendor Advisory
• https://twitter.com/CVEnew/status/1737184340155773005 · Twitter Post
• https://t.me/cvenotify/64232 · Telegram Post