PT-2024-18251 · Hypr · Hypr Passwordless

Published 2024-05-21 · Updated 2024-05-21 · CVE-2024-1721

Positive Technologies (AI Summary)

CVSS v4.0

5.6

Medium

Base vector

AV:L/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Green

Name of the Vulnerable Software and Affected Versions HYPR Passwordless versions prior to 9.1

Description The issue is related to an Improper Verification of Cryptographic Signature vulnerability in HYPR Passwordless on Windows, which allows for a Malicious Software Update.

Recommendations For versions prior to 9.1, update to version 9.1 or later to resolve the issue.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2024-1721

Affected Products

Hypr Passwordless

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-1721 · Security Note
• https://hypr.com/trust-center/security-advisories · Note
• https://twitter.com/VulmonFeeds/status/1793006892354068913 · Twitter Post