PT-2024-29958 · Upkeeper Solutions · Upkeeper Manager

Published 2024-08-16 · Updated 2024-08-28 · CVE-2024-42462

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions upKeeper Manager versions through 5.1.9

Description The issue is related to an improper authentication vulnerability in the upKeeper Solutions product, upKeeper Manager, which allows authentication bypass. This means that attackers can potentially bypass the authentication mechanism, gaining unauthorized access to the system.

Recommendations For versions through 5.1.9, update to a version later than 5.1.9 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this vulnerability.

Fix

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

CVE-2024-42462

Affected Products

Upkeeper Manager

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-42462 · Security Note
• https://support.upkeeper.se/hc/en-us/articles/15432045399452-CVE-2024-42462-Bypass-multifactor-authentication · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-42462 · Vendor Advisory
• https://t.me/cvenotify/90908 · Telegram Post
• https://twitter.com/CVEnew/status/1824440081219801311 · Twitter Post
• https://t.me/cvenotify/92599 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1824504258525282489 · Twitter Post
• https://twitter.com/CveFindCom/status/1824469060240720079 · Twitter Post
• https://t.me/cvedetector/3335 · Telegram Post