PT-2024-30263 · Autman · Autman

Published 2024-08-23 · Updated 2024-08-27 · CVE-2024-43032

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions autMan version 2.9.6

Description The issue allows attackers to bypass authentication via a crafted web request. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For autMan version 2.9.6, upgrade to a version that contains a fix for this issue, as the current version is affected. However, according to one of the sources, upgrading to version 2.9.6 is actually the remediation for versions up to 2.9.5, indicating a potential contradiction in the information provided. Given this discrepancy, it's crucial to consult the latest advisory from the vendor for accurate remediation steps. At the moment, there is no clear information about a newer version that contains a fix for this specific issue in version 2.9.6, suggesting a need for further clarification from the vendor.

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2024-43032

Affected Products

Autman

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-43032 · Security Note
• https://osv.dev/vulnerability/CVE-2024-43032 · Vendor Advisory
• https://github.com/hdbjlizhe/fanli/releases/tag/2.9.6 · Note
• https://twitter.com/transilienceai/status/1828375357939941607 · Twitter Post
• https://t.me/cvenotify/91985 · Telegram Post
• https://twitter.com/CVEnew/status/1827007857700807019 · Twitter Post
• https://t.me/cvedetector/4011 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1827073374998151478 · Twitter Post