PT-2024-17418 · Oauth · Oauth

Published 2024-12-04 · Updated 2024-12-04 · CVE-2024-12056

Positive Technologies (AI Summary)

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/AU:N/R:U/RE:M/U:Green

Name of the Vulnerable Software and Affected Versions OAuth (affected versions not specified)

Description The issue arises when using the OAuth Password grant type, as the Client secret is not checked. This allows an attacker to connect to a web server using a client application that is not explicitly authorized as part of the OAuth deployment. Exploitation requires valid credentials, and it does not permit the attacker to bypass user privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improperly Implemented Security Check for Standard

Weakness Enumeration

CWE-358

Related Identifiers

CVE-2024-12056

Affected Products

Oauth

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-12056 · Security Note
• https://pcvue.com/security/security/#SB2024-4 · Vendor Advisory
• https://twitter.com/CVEnew/status/1864321769970258372 · Twitter Post
• https://t.me/cvedetector/12009 · Telegram Post