PT-2024-29780 · Fiware · Fiware Keyrock

Wolfgang Hotwagner · Published 2024-08-12 · Updated 2024-08-29 · CVE-2024-42163

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions FIWARE Keyrock versions <= 8.4

Description The issue is related to insufficiently random values for generating password reset tokens, allowing attackers to take over the account of any user by predicting the token for the password reset link. This enables attackers to potentially gain unauthorized access to user accounts.

Recommendations For FIWARE Keyrock versions <= 8.4, update to a version that includes a fix for the insufficiently random password reset token generation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2024-42163

Affected Products

Fiware Keyrock

References · 10

• 🔥 https://ait.ac.at/themen/cyber-security/pentesting/security-advisories · Exploit
• https://osv.dev/vulnerability/CVE-2024-42163 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42163 · Security Note
• https://twitter.com/cracbot/status/1824325319576477885 · Twitter Post
• https://twitter.com/cracbot/status/1823600528821256506 · Twitter Post
• https://twitter.com/Aptallar09/status/1823024915743949228 · Twitter Post
• https://twitter.com/CVEnew/status/1822960523526209898 · Twitter Post
• https://twitter.com/cracbot/status/1823962922886029806 · Twitter Post
• https://twitter.com/CveFindCom/status/1822981549819601312 · Twitter Post
• https://twitter.com/PorsilapongoCl/status/1822961268690472970 · Twitter Post