PT-2024-31692 · Identity Automation · Rapididentity Cloud+1

Ben Rogozinski · Published 2024-09-05 · Updated 2024-09-12 · CVE-2024-45589

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: RapidIdentity LTS versions 2023.0.2 and earlier RapidIdentity Cloud versions 2024.08.0 and earlier

Description: The issue allows a remote attacker to cause a denial of service via the username parameters by improperly restricting excessive authentication attempts.

Recommendations: For RapidIdentity LTS versions 2023.0.2 and earlier, consider restricting access to authentication mechanisms to minimize the risk of exploitation. For RapidIdentity Cloud versions 2024.08.0 and earlier, consider implementing rate limiting on authentication attempts as a temporary workaround. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2024-45589

Affected Products

Rapididentity Cloud

Rapididentity Lts

References · 8

• 🔥 https://benrogozinski.github.io/CVE-2024-45589 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-45589 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45589 · Vendor Advisory
• https://t.me/cvenotify/94388 · Telegram Post
• https://t.me/cvedetector/4924 · Telegram Post
• https://twitter.com/CVEnew/status/1831734996786184501 · Twitter Post
• https://help.rapididentity.com/docs/rapididentity-lts-release-notes · Note
• https://twitter.com/VulmonFeeds/status/1831784257343152388 · Twitter Post