PT-2024-15959 · Okta · Workforce Identity Cloud+2

Published 2024-07-23 · Updated 2024-08-29 · CVE-2024-0981

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Okta Browser Plugin versions 6.5.0 through 6.31.0

Description The issue occurs due to a cross-site scripting flaw when the Okta Browser Plugin prompts the user to save credentials within Okta Personal. This is resolved by properly escaping fields. If Okta Personal is not added to the plugin for multi-account view, the Workforce Identity Cloud plugin is not affected.

Recommendations For Okta Browser Plugin versions 6.5.0 through 6.31.0, update to version 6.32.0 to fix the issue. As a temporary workaround, consider avoiding the use of Okta Personal with the plugin until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-0981

Affected Products

Okta Browser Plugin

Okta Personal

Workforce Identity Cloud

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-0981 · Security Note
• https://trust.okta.com/security-advisories/okta-browser-plugin-reflected-cross-site-scripting-cve-2024-0981 · Vendor Advisory
• https://twitter.com/Komodosec/status/1829172933836853659 · Twitter Post
• https://t.me/pentestingnews/49396 · Telegram Post
• https://t.me/cvedetector/1526 · Telegram Post