PT-2024-29782 · Fiware · Fiware Keyrock

Wolfgang Hotwagner · Published 2024-08-12 · Updated 2024-08-29 · CVE-2024-42165

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions FIWARE Keyrock versions <= 8.4

Description The issue is related to insufficiently random values used for generating activation tokens. This allows attackers to predict the token for the activation link, enabling them to activate accounts of any user.

Recommendations For FIWARE Keyrock versions <= 8.4, update to a version that includes a fix for this issue to prevent attackers from predicting activation tokens.

Exploit

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2024-42165

Affected Products

Fiware Keyrock

References · 5

• 🔥 https://ait.ac.at/themen/cyber-security/pentesting/security-advisories · Exploit
• https://osv.dev/vulnerability/CVE-2024-42165 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42165 · Security Note
• https://twitter.com/CVEnew/status/1822964103700234515 · Twitter Post
• https://twitter.com/PorsilapongoCl/status/1822965129081692257 · Twitter Post