PT-2024-28392 · Kaiten · Kaiten

Artemy-Ccrsky · Published 2024-07-04 · Updated 2024-08-22 · CVE-2024-39211

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kaiten version 57.128.8

Description The issue allows remote attackers to enumerate user accounts via a crafted POST request. This is possible because a login response contains a user email field only if the user account exists.

Recommendations For Kaiten version 57.128.8, consider modifying the login response to not include the user email field, or implement additional checks to prevent user account enumeration. As a temporary workaround, restrict access to the login endpoint to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2024-39211

Affected Products

Kaiten

References · 8

• 🔥 https://github.com/artemy-ccrsky/CVE-2024-39211/blob/main/CVE-2024-39211.sh · Exploit
• 🔥 https://github.com/artemy-ccrsky/CVE-2024-39211 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-39211 · Security Note
• https://twitter.com/CVEnew/status/1808846599289766383 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1808820776167977452 · Twitter Post
• https://t.me/cvenotify/85179 · Telegram Post
• https://kaiten.ru · Note
• https://t.me/cvedetector/54 · Telegram Post