PT-2024-29961 · Unknown · Upkeeper Manager

Published 2024-08-16 · Updated 2024-08-28 · CVE-2024-42465

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions upKeeper Manager versions through 5.1.9

Description The issue is related to an improper restriction of excessive authentication attempts in upKeeper Manager, allowing authentication abuse. This problem can be exploited, potentially leading to unauthorized access.

Recommendations For versions through 5.1.9, update to a version later than 5.1.9 to resolve the issue. As a temporary workaround, consider implementing additional authentication controls or restrictions to minimize the risk of exploitation. Restrict access to authentication mechanisms to prevent abuse.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2024-42465

Affected Products

Upkeeper Manager

References · 9

• https://support.upkeeper.se/hc/en-us/articles/15432332385564-CVE-2024-42465-Lack-of-resources-and-rate-limiting-two-factor-authentication · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-42465 · Security Note
• https://osv.dev/vulnerability/CVE-2024-42465 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1824506528348430532 · Twitter Post
• https://t.me/cvenotify/90911 · Telegram Post
• https://twitter.com/CVEnew/status/1824440077382004995 · Twitter Post
• https://twitter.com/CveFindCom/status/1824453946628243675 · Twitter Post
• https://t.me/cvedetector/3331 · Telegram Post
• https://t.me/cvenotify/92590 · Telegram Post